"Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader" published by Socket. #ContagiousInterview, #NPM, #XORIndex, #DPRK, #CTI https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages
Administered by:
#contagiousinterview
0 posts0 participants0 posts today
"Inside North Korea's Global Cyber Playbook" published by Proofpoint. #ContagiousInterview, #ITWorker, #Podcast, #TA427, #DPRK, #CTI https://podcasts.apple.com/us/podcast/comic-sans-and-cybercrime-inside-north-koreas-global/id1612506550?i=1000715261677
Apple PodcastsComic Sans and Cybercrime: Inside North Korea’s Global Cyber PlaybookPodcast Episode · DISCARDED: Tales From the Threat Research Trenches · 07/01/2025 · 53m
"Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages" published by Socket. #BeaverTail, #ContagiousInterview, #HexEval, #NPM, #DPRK, #CTI https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages
"These North Korean phishers just don't stop" published by dazhengzhang. #ContagiousInterview, #DPRK, #CTI https://archive.is/LbK6h
"WaterPlumが使用するマルウェアOtterCookieの機能追加" published by NTTSecurity. #OtterCookie, #WaterPlum, #ContagiousInterview, #DPRK, #CTI https://jp.security.ntt/tech_blog/waterplum-ottercookie
NTT Security Holdings · WaterPlumが使用するマルウェアOtterCookieの機能追加 | NTTセキュリティテクニカルブログ{}
"Additional Features of OtterCookie Malware Used by WaterPlum" published by NTTSecurity. #OtterCookie, #WaterPlum, #ContagiousInterview, #DPRK, #CTI https://jp.security.ntt/tech_blog/en-waterplum-ottercookie
NTT Security Holdings · Additional Features of OtterCookie Malware Used by WaterPlum | NTTセキュリティテクニカルブログ{}
"Now that the cat is out of the bag regarding the use of front companies like BlockNovas LLC" published by TeamCymru. #ContagiousInterview, #DPRK, #CTI https://archive.is/E2Hcp
"Rolling in the Deep(Web): Lazarus Tsunami" published by HISolutions. #ContagiousInterview, #Tsunami, #DPRK, #CTI https://research.hisolutions.com/2025/04/rolling-in-the-deepweb-lazarus-tsunami/
HiSolutions Research · Rolling in the Deep(Web): Lazarus TsunamiThe „Contagious Interview“ campaign to steal crypto currencies is still going on. We share our analysis of a comprehensive sample of the Tsunami framework used by the Lazarus group together with Yara rules and IoC to help detecting it.
good thing the US is gutting beneficial ownership regulations that would make it easier to understand who actually owns US trusts and corporations while simultaneously trashing both crypto enforcement at the DOJ but also more generally cyber defense
"The companies, Blocknovas LLC and Softglide LLC, were set up in the states of #NewMexico and New York using fake personas and addresses."
* Reuters: https://www.reuters.com/sustainability/boards-policy-regulation/north-korean-cyber-spies-created-us-firms-dupe-crypto-developers-2025-04-24/
* Technical details from Silent Push: https://www.silentpush.com/blog/contagious-interview-front-companies/
"Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware" published by Silentpush. #BeaverTail, #ContagiousInterview, #InvisibleFerret, #OtterCookie, #FamousChollima, #ClickFix, #DPRK, #CTI https://www.silentpush.com/blog/contagious-interview-front-companies/
Silent Push · Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware: BeaverTail, InvisibleFerret, and OtterCookieContagious Interview (DPRK) have launched a new campaign involving three front companies that deliver BeaverTail, InvisibleFerret, and OtterCookie malware.
"Interview with the Chollima" published by BirminghamCyber. #ContagiousInterview, #OtterCookie, #DPRK, #CTI https://quetzal.bitso.com/p/interview-with-the-chollima
Bitso Quetzal Team · Interview with the Chollima
"Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads" published by Socket. #BeaverTail, #ContagiousInterview, #Lazarus, #NPM, #DPRK, #CTI https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket
SocketLazarus Expands Malicious npm Campaign: 11 New Packages Add ...Lazarus-linked threat actors expand their npm malware campaign with new RAT loaders, hex obfuscation, and over 5,600 downloads across 11 packages.
"From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic" published by SEKOIA. #ClickFix, #ContagiousInterview, #GolangGhost, #Lazarus, #FrostyFerret, #DPRK, #CTI https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/
Sekoia.io Blog · From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tacticDiscover how Lazarus leverages fake job sites in the ClickFake Interview campaign targeting crypto firms using the ClickFix tactic.
"Cómo domar un Chollima" published by BirminghamCyber. #ChaoticCapybara, #VelvetChollima, #macOS, #ContagiousInterview, #DPRK, #CTI https://news.mefiltraron.com/p/edicion-especial-como-domar-un-chollima
MeFiltraron · Edición Especial: Cómo domar un Chollima
"Analysis of LinkedIn Recruitment Phishing" published by Slowmist. #ContagiousInterview, #DPRK, #CTI https://slowmist.medium.com/slowmist-analysis-of-linkedin-recruitment-phishing-4b4b55e02bf4
Medium · SlowMist: Analysis of LinkedIn Recruitment Phishing
"I just got a scam attempt by a Linkedin "recruiter"" published by Bruno. #ContagiousInterview, #DPRK, #CTI https://archive.md/yJ5iY
"Another day another North Korean scammer" published by dazhengzhang. #ContagiousInterview, #DPRK, #CTI https://archive.is/WxtB0
"Astrill VPN: Silent Push Publicly Releases New IPs on VPN Service Heavily Used by North Korean Threat Actors" published by Silentpush. #ContagiousInterview, #FamousChollima, #DPRK, #CTI https://www.silentpush.com/blog/astrill-vpn/
Silent Push · Astrill VPN: Silent Push Publicly Releases New IPs on VPN Service Heavily Used by North Korean Threat ActorsSilent Push reveals Astrill VPN is still being heavily used by NK Lazarus Group threat actors to hide their IP addresses during attacks
"RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector" published by PaloaltoNetworks. #ContagiousInterview, #Koi, #RustDoor, #macOS, #AlluringPisces, #DPRK, #CTI https://unit42.paloaltonetworks.com/macos-malware-targets-crypto-sector/
Unit 42 · RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector
"DPRK DriverEasy & ChromeUpdate Deep Dive" published by Kandji. #ContagiousInterview, #DriverEasy, #DPRK, #CTI https://www.kandji.io/blog/drivereasy
www.kandji.ioDPRK DriverEasy & ChromeUpdate Deep DiveDeep-dive into North Korea's malicious job interview scams; analyzing how DriverEasy & ChromeUpdate steal credentials via fake Google prompts & Dropbox APIs.