Hunting North Korea’s Contagious Interview Operation

Why It Matters

The operation demonstrates how state‑backed actors can weaponize open‑source ecosystems to infiltrate global developer communities, making supply‑chain security a critical priority for all software firms.

Key Takeaways

• North Korean actors use fake recruiter interviews to deliver malware.
• Malicious npm packages exploit typo‑squatting and AI suggestions.
• Campaign deploys multi‑stage loaders like Beaver Tail and Invisible Ferret.
• Thousands of developers infected; hundreds of packages downloaded tens of thousands times.
• Defense requires signatures, supply‑chain monitoring, and heightened developer vigilance.

Summary

The presentation by senior threat analyst Kir Boyenko details North Korea’s state‑sponsored “contagious interview” campaign, which masquerades as recruiter outreach, test assignments, or take‑home exams to trick developers into executing malicious code. By targeting open‑source ecosystems—primarily npm, but also Python, Rust, Go, and VS Code extensions—the actors embed malware directly into the software supply chain.

The operation relies on typo‑squatting, AI‑generated package recommendations, and automated mass publishing. Hundreds of malicious packages have been released, amassing tens of thousands of downloads and compromising thousands of developer machines. The malware zoo includes multi‑stage loaders such as Beaver Tail, Auto‑Cookookie, and Invisible Ferret, which steal browser credentials, cryptocurrency wallets, and even macOS keychains before fetching additional payloads.

A striking example is a typo‑squatted npm package that mirrors a legitimate library’s README, then executes obfuscated JavaScript containing a curl command to a C2 server on port 1224. The speaker cites colleague Rachel Cook’s “fat‑finger syndrome” video, illustrating how rushed developers or AI‑driven suggestions can inadvertently install these trojanized modules.

The campaign’s scale—continuous weekly releases, hundreds of aliases, and a factory‑like production model—means organizations must adopt proactive defenses: generate detection signatures, monitor supply‑chain integrity, enforce strict package vetting, and educate developers about social‑engineering lures. Failure to do so risks further crypto theft and broader credential compromise.

Original Description

Hunting North Korea’s State-Sponsored “Contagious Interview” Operation: Attacks on Developers via the Software Supply Chain

🎙️ Kirill Boychenko, Senior Threat Intelligence Analyst, Socket

📍 Presented at SANS CTI Summit 2026

North Korean state-sponsored threat actors behind the “Contagious Interview” operation blend social engineering with malicious open source packages to compromise developers and tech job seekers. Throughout 2025, we identified and analyzed hundreds of malicious npm packages (thousands of downloads) delivering stealthy, multi-stage loaders and infostealers that fetch the BeaverTail malware and the InvisibleFerret backdoor.

Operators pose as recruiters on LinkedIn, deliver “coding assignments” via GitHub, Bitbucket, and Google Docs, and pressure targets to execute code locally. The activity spans hundreds of aliases and numerous C2 endpoints, with dozens of packages remaining live at disclosure and new uploads appearing continuously in the npm registry.