North Korean threat actors responsible for the “Contagious Interview” campaign have flooded the npm registry with 197 additional malicious packages since last month. According to a Socket analysis, these packages have accumulated more than 31,000 downloads and are designed to distribute a variant of OtterCookie that combines features from BeaverTail and previous versions of OtterCookie.
Infection Mechanism and Malware Capabilities
The malware, once executed, performs various evasion actions, profiles the compromised machine and establishes a command and control (C2) channel. This channel provides attackers with remote shell and data theft capabilities, including:
- Clipboard content theft.
- Keystroke registration (keylogging).
- Capture screenshots.
- Browser credentials extraction.
- Document collection.
- Data theft from cryptocurrency wallets and seed phrases.
The “Contagious Interview” campaign relies on social engineering, tricking users into running a Node.js application as part of a fake job interview process. This attack technique was previously documented by Cisco Talos, which identified an infection on a system of an organization in Sri Lanka.
Malicious Packages Identified
Some of the loader packages identified in this campaign include:
- bcryptjs-node
- cross-sessions
- json-oauth
- node-tailwind
- react-adparser
- session-keeper *tailwind-magic
- tailwindcss-forms
- webpack-loadcss
Delivery Infrastructure and Parallel Campaign “ClickFake Interview”
Analysis of Contagious Interview’s infrastructure reveals that the packages are programmed to connect to a hard-coded Vercel URL (“tetrismic.vercel[.]app”). This URL in turn downloads the OtterCookie payload from a GitHub repository controlled by the attackers. Although the GitHub account (“stardev0914”) used for delivery is no longer accessible, the campaign demonstrates sophisticated use of legitimate services for malware distribution.
In parallel, the same threat actors have created fake evaluation websites that use ClickFix-style instructions to deliver malware known as GolangGhost (also called FlexibleFerret or WeaselStore). Under the guise of fixing camera or microphone issues, users are tricked into downloading and running the malware.
Features of GolangGhost (“ClickFake Interview” Malware)
The GolangGhost malware, written in Go, contacts an encrypted C2 server and enters a persistent command processing loop. Its capabilities include:
- Collection of system information.
- File upload and download.
- Execution of operating system commands.
- Google Chrome information harvesting.
To achieve persistence on macOS systems, the malware installs a LaunchAgent that runs automatically when the user logs in. During the attack, a decoy application is also installed that displays a fake Chrome camera access prompt, followed by a fake Chrome password prompt to capture the credentials entered by the user and send them to a Dropbox account.
Conclusions and Strategic Context
According to researcher Kirill Boychenko, the sustained pace of this campaign makes it one of the most prolific exploiting npm, demonstrating how North Korean actors have adapted their tools to modern development workflows based on JavaScript and cryptocurrencies.
Unlike other North Korean “IT worker” schemes that seek to infiltrate actors into legitimate companies, the Contagious Interview campaign focuses on compromising individuals through falsified recruitment processes, malicious coding exercises, and fraudulent recruiting platforms, weaponizing the job application process itself.
References
- C2 Vercel URL: tetrismic.vercel[.]app
- Delivery GitHub repository: stardev0914