Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Contagious Interview campaign, linked to North Korean actors, has evolved to use JSON storage services for hosting and delivering malware. This campaign targets software developers, particularly those in cryptocurrency and Web3 projects, across Windows, Linux, and macOS. The attackers use social engineering tactics, including fake recruiter profiles, to deliver trojanized code during staged job interviews. The malware payload includes BeaverTail and OtterCookie infostealers, along with the InvisibleFerret RAT. The attack chain involves multiple stages, from initial contact to malware delivery, utilizing legitimate websites like JSON Keeper and code repositories to operate stealthily. The campaign also incorporates additional components such as the Tsunami Payload, which adds exceptions to Windows Defender and creates scheduled tasks.

The Contagious Interview campaign is a sophisticated cyber espionage and malware delivery operation linked to North Korean threat actors. It specifically targets software developers working in cryptocurrency and Web3 projects across Windows, Linux, and macOS platforms. The attackers employ social engineering by creating fake recruiter profiles to engage victims in staged job interviews, during which they deliver trojanized code. This code is hosted on legitimate JSON storage services such as JSON Keeper and popular code repositories, allowing the attackers to evade traditional detection mechanisms by blending malicious payloads with legitimate web traffic. The malware payload includes BeaverTail and OtterCookie infostealers designed to exfiltrate sensitive information, and the InvisibleFerret Remote Access Trojan (RAT) that provides persistent remote control over infected systems. Additionally, the campaign uses the Tsunami Payload, which modifies Windows Defender to add exceptions and creates scheduled tasks to maintain persistence and evade endpoint security. The attack chain is multi-staged, starting from initial social engineering contact, progressing through delivery of trojanized code, and culminating in the deployment of multiple malware components. The use of legitimate services for hosting payloads and the targeting of niche developer communities make this campaign particularly stealthy and effective. The campaign leverages various MITRE ATT&CK techniques such as T1053 (Scheduled Task), T1562 (Impair Defenses), T1566 (Phishing), and T1204 (User Execution), highlighting its complexity and sophistication. No known public exploits exist for this campaign, but its reliance on social engineering and multi-platform malware increases its threat potential.

Detailed information about Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery. Get real-time updates, technical details, and mit

Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery - Live Threat Intelligence - Threat Radar | OffSeq.com

Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery

Title	Severity	Type	Source	Date

Threats Tagged 'json storage'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'json storage'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility