Contagious Interview steps outside the developer workflow

Jamf Threat Labs identified 14 trojanized macOS applications distributed as DMG and PKG files mimicking legitimate software such as The Unarchiver, Sketch, and Bartender. These unsigned, modified applications contain hidden executables that download staging scripts from infrastructure at 162.0.239.85. The multi-stage attack culminates in the deployment of OtterCookie malware, which enables remote access, steals credentials from browsers and cryptocurrency wallets, scans the filesystem, and monitors clipboard data. The campaign is attributed to DPRK threat actors and uses fake job interviews as a lure. This delivery method marks a shift from prior Git hook and VS Code task-based attacks to standalone installer packages that require manual quarantine attribute removal to run.

The malware provides attackers with persistent remote access to infected macOS systems, enabling credential theft from browsers and crypto wallets, filesystem reconnaissance, and clipboard monitoring. This could lead to significant data compromise and unauthorized access to sensitive information. The use of trojanized installers increases the likelihood of successful infection through social engineering.

No official patch or remediation is indicated. Mitigation involves user education to avoid installing software from untrusted sources and careful inspection of installer packages. Users should be cautious of unsolicited job interview invitations and avoid removing quarantine attributes from unknown installers. Endpoint protection solutions that detect OtterCookie or related behaviors may help prevent infection.