Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery
Essential information
- Published
- 14/11/2025 12:25
- Modified
- 14/11/2025 13:10
- Tags
- 2025-11-14 beavertail cryptocurrency infostealer invisibleferret json storage north korea ottercookie rat social engineering trojanized code tsunami payload web3
- Related entities
- 84 observables, 1 intrusion sets (apt), 15 techniques (mitre), 4 malware, 2 others
Description
The Contagious Interview campaign, linked to North Korean actors, has evolved to use JSON storage services for hosting and delivering malware. This campaign targets software developers, particularly those in cryptocurrency and Web3 projects, across Windows, Linux, and macOS. The attackers use social engineering tactics, including fake recruiter profiles, to deliver trojanized code during staged job interviews. The malware payload includes BeaverTail and OtterCookie infostealers, along with the InvisibleFerret RAT. The attack chain involves multiple stages, from initial contact to malware delivery, utilizing legitimate websites like JSON Keeper and code repositories to operate stealthily. The campaign also incorporates additional components such as the Tsunami Payload, which adds exceptions to Windows Defender and creates scheduled tasks.