"SEAL weekly stats: Sept. 15-22, 2026" published by SecurityAlliance. #UNC1069, #ContagiousInterview, #SINT01 https://radar.securityalliance.org/seal-weekly-stats-sept-15-22-2026
SEAL weekly stats: Sept. 15-22, 2026
radar.securityalliance.org
September 23, 2026 at 12:05 AM
"SEAL weekly stats: Sept. 15-22, 2026" published by SecurityAlliance. #UNC1069, #ContagiousInterview, #SINT01 https://radar.securityalliance.org/seal-weekly-stats-sept-15-22-2026
"Contagious Interview steps outside the developer workflow" published by Jamf. #macOS, #ContagiousInterview, #OtterCookie https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers
Contagious Interview steps outside the developer workflow
www.jamf.com
September 3, 2026 at 4:14 PM
"Contagious Interview steps outside the developer workflow" published by Jamf. #macOS, #ContagiousInterview, #OtterCookie https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers
"From fake interviews to malicious repositories: Disrupting Contagious Interview" published by Atlassian. #ContagiousInterview, #BeaverTail, #InvisibleFerret, #FamousChollima, #OtterCookie, #GolangGhost, #PylangGhost https://www.atlassian.com/blog/how-we-build/disrupting-contagious-interview
From fake interviews to malicious repositories: Disrupting Contagious Interview
www.atlassian.com
September 22, 2026 at 5:06 AM
"From fake interviews to malicious repositories: Disrupting Contagious Interview" published by Atlassian. #ContagiousInterview, #BeaverTail, #InvisibleFerret, #FamousChollima, #OtterCookie, #GolangGhost, #PylangGhost https://www.atlassian.com/blog/how-we-build/disrupting-contagious-interview
"PolinRider Confirmed Footprint Grows 6.5x Since March" published by OpenSourceMalware. #SupplyChain, #GitHub, #ContagiousInterview, #PolinRider, #TasksJacker https://opensourcemalware.com/blog/polinrider-blast-radius-grows
https://opensourcemalware.com/blog/polinrider-blast-radius-grows
opensourcemalware.com
July 15, 2026 at 11:55 PM
"PolinRider Confirmed Footprint Grows 6.5x Since March" published by OpenSourceMalware. #SupplyChain, #GitHub, #ContagiousInterview, #PolinRider, #TasksJacker https://opensourcemalware.com/blog/polinrider-blast-radius-grows
DeceptiveDevelopment (aka ContagiousInterview) is a North Korea-aligned threat actor targeting freelance developers and crypto professionals. It uses fake job offers, AI-generated investor videos, and the WeaselStore backdoor delivered via fake interview sites (ClickFix). 2/3
August 21, 2025 at 9:33 AM
DeceptiveDevelopment (aka ContagiousInterview) is a North Korea-aligned threat actor targeting freelance developers and crypto professionals. It uses fake job offers, AI-generated investor videos, and the WeaselStore backdoor delivered via fake interview sites (ClickFix). 2/3
Check out our blogs on incidents we detected and responded to with #malware leveraged in the #contagiousinterview campaigns attributed to #DPRK #threatactors #threatintel
www.esentire.com/blog/bored-b...
www.esentire.com/blog/bored-b...
www.esentire.com/blog/bored-b...
www.esentire.com/blog/bored-b...
Bored BeaverTail Yacht Club – A Lazarus Lure
Learn more about the BeaverTail malware, and get security recommendations from our Threat Response Unit (TRU) to protect your business from this cyber…
www.esentire.com
November 26, 2024 at 10:09 PM
Check out our blogs on incidents we detected and responded to with #malware leveraged in the #contagiousinterview campaigns attributed to #DPRK #threatactors #threatintel
www.esentire.com/blog/bored-b...
www.esentire.com/blog/bored-b...
www.esentire.com/blog/bored-b...
www.esentire.com/blog/bored-b...
"How DPRK’s Contagious Interview Campaign Targets Developers" published by KudelskiSecurity. #Cryptocurrency, #GitHub, #NPM, #ContagiousInterview, #VSCode, #T1041, #T1071001, #T1059007 https://kudelskisecurity.com/research/how-dprks-contagious-interview-campaign-targets-developers
How DPRK’s Contagious Interview Campaign Targets Developers
Lazarus Day source report announcement
kudelskisecurity.com
July 6, 2026 at 12:04 AM
"How DPRK’s Contagious Interview Campaign Targets Developers" published by KudelskiSecurity. #Cryptocurrency, #GitHub, #NPM, #ContagiousInterview, #VSCode, #T1041, #T1071001, #T1059007 https://kudelskisecurity.com/research/how-dprks-contagious-interview-campaign-targets-developers
👉 REGISTER: hubs.ly/Q03qQHc-0
North Korea’s state-sponsored threat actors show no signs of slowing down. Join us on June 10 to dive into the evolving TTPs of 'Contagious Interview' — a subgroup of Lazarus APT.
#lazarusapt #infosec #contagiousinterview #threat #cti #cybersecurity #webinar
North Korea’s state-sponsored threat actors show no signs of slowing down. Join us on June 10 to dive into the evolving TTPs of 'Contagious Interview' — a subgroup of Lazarus APT.
#lazarusapt #infosec #contagiousinterview #threat #cti #cybersecurity #webinar
June 5, 2025 at 2:38 PM
👉 REGISTER: hubs.ly/Q03qQHc-0
North Korea’s state-sponsored threat actors show no signs of slowing down. Join us on June 10 to dive into the evolving TTPs of 'Contagious Interview' — a subgroup of Lazarus APT.
#lazarusapt #infosec #contagiousinterview #threat #cti #cybersecurity #webinar
North Korea’s state-sponsored threat actors show no signs of slowing down. Join us on June 10 to dive into the evolving TTPs of 'Contagious Interview' — a subgroup of Lazarus APT.
#lazarusapt #infosec #contagiousinterview #threat #cti #cybersecurity #webinar
Nordkoreanische Cybergruppe bestiehlt IT-Fachleute auf Jobsuche | Security https://www.heise.de/news/Nordkoreanische-Cybergruppe-bestiehlt-IT-Fachleute-auf-Jobsuche-11458275.html #contagiousinterview #socialengineering #malware #nordkorea 🇰🇵 #northkorea 🇰🇵
Nordkoreanische Cybergruppe bestiehlt IT-Fachleute auf Jobsuche
Sicherheitsbehörden warnen vor einer Cybergruppe aus Nordkorea, die gezielt IT-Spezialisten angreift. Was hinter der Kampagne „Contagious Interview“ steckt.
www.heise.de
September 20, 2026 at 6:34 PM
Nordkoreanische Cybergruppe bestiehlt IT-Fachleute auf Jobsuche | Security https://www.heise.de/news/Nordkoreanische-Cybergruppe-bestiehlt-IT-Fachleute-auf-Jobsuche-11458275.html #contagiousinterview #socialengineering #malware #nordkorea 🇰🇵 #northkorea 🇰🇵
"Lazarus APT: Techniques for Hunting Contagious Interview" published by Validin. #ContagiousInterview, #Lazarus, #ClickFix, #DPRK, #CTI https://www.validin.com/blog/inoculating_contagious_interview_with_validin/
January 16, 2025 at 11:30 PM
"Lazarus APT: Techniques for Hunting Contagious Interview" published by Validin. #ContagiousInterview, #Lazarus, #ClickFix, #DPRK, #CTI https://www.validin.com/blog/inoculating_contagious_interview_with_validin/
📣 New Podcast! "North Korean Hackers Steal $10.7 Million in Crypto Through Fake Job Listings" on @Spreaker #blockchainsecurity #contagiousinterview #cryptocurrencyhack #cryptocurrencynews #cryptocurrencysecurity #cryptocurrencytheft #cryptohacking #cryptoscam #cryptowallets #cyberattack
North Korean Hackers Steal $10.7 Million in Crypto Through Fake Job Listings
https://www.osintinvestigate.com
North Korea-linked hackers reportedly compromised more than 30,000 devices and over 7,000 crypto wallets using fake job offers, stealing at least $10.7 million in digital assets.
www.spreaker.com
September 21, 2026 at 4:00 PM
📣 New Podcast! "North Korean Hackers Steal $10.7 Million in Crypto Through Fake Job Listings" on @Spreaker #blockchainsecurity #contagiousinterview #cryptocurrencyhack #cryptocurrencynews #cryptocurrencysecurity #cryptocurrencytheft #cryptohacking #cryptoscam #cryptowallets #cyberattack
"Chai.js 플러그인으로 위장한 북한발 npm 악성 패키지 'chai-as-init' 분석" published by ESTSecurity. #ContagiousInterview, #NPM, #DPRK, #CTI https://blog.alyac.co.kr/5766
June 17, 2026 at 1:30 PM
"Chai.js 플러그인으로 위장한 북한발 npm 악성 패키지 'chai-as-init' 분석" published by ESTSecurity. #ContagiousInterview, #NPM, #DPRK, #CTI https://blog.alyac.co.kr/5766
Discover how the North Korean WaterPlum cyber actor group uses fake job interviews to steal crypto and infiltrate networks globally.
#WaterPlum #CyberSecurity #ContagiousInterview #NorthKorea #Malware
#WaterPlum #CyberSecurity #ContagiousInterview #NorthKorea #Malware
The WaterPlum Cyber Actor Group Targets Global IT Professionals
At a Glance Summary Attribute Details Actor or Group North Korean WaterPlum cyber actor group (Contagious Interview) Activity Type Fake job recruitment, malware distribution, and cryptocurrency theft Targets or Victims Individual IT professionals, software developers, and web freelancers Scale Over 30,000 devices infected; $10.71 million USD claimed stolen Jurisdiction / Status Suspected state-sponsored actors under the 313 General Bureau Source…
securityonline.info
September 23, 2026 at 7:19 AM
Discover how the North Korean WaterPlum cyber actor group uses fake job interviews to steal crypto and infiltrate networks globally.
#WaterPlum #CyberSecurity #ContagiousInterview #NorthKorea #Malware
#WaterPlum #CyberSecurity #ContagiousInterview #NorthKorea #Malware
"North Korea-nexus Golang Backdoor/Stealer from Contagious Interview campaign" published by dmpdump. #ContagiousInterview, #DPRK, #CTI https://dmpdump.github.io/posts/NorthKorea_Backdoor_Stealer/
January 6, 2025 at 11:30 AM
"North Korea-nexus Golang Backdoor/Stealer from Contagious Interview campaign" published by dmpdump. #ContagiousInterview, #DPRK, #CTI https://dmpdump.github.io/posts/NorthKorea_Backdoor_Stealer/
"DPRK Contagious Interview: Developer Workflow Compromise" published by Domaintools. #ContagiousInterview, #Lazarus, #DPRK, #CTI https://dti.domaintools.com/securitysnacks/dprk-contagious-interview-developer-workflow-compromise
May 4, 2026 at 1:30 PM
"DPRK Contagious Interview: Developer Workflow Compromise" published by Domaintools. #ContagiousInterview, #Lazarus, #DPRK, #CTI https://dti.domaintools.com/securitysnacks/dprk-contagious-interview-developer-workflow-compromise
"A Security Pro Hacked North Korean Hackers. He Found They’d Breached Hundreds of Networks Worldwide" published by Wired. #News, #ContagiousInterview, #ITWorker https://www.wired.com/story/a-security-pro-hacked-north-korean-hackers-he-found-theyd-breached-hundreds-of-networks-worldwide/
A Security Pro Hacked North Korean Hackers. He Found They’d Breached Hundreds of Networks Worldwide
www.wired.com
August 6, 2026 at 5:41 AM
"A Security Pro Hacked North Korean Hackers. He Found They’d Breached Hundreds of Networks Worldwide" published by Wired. #News, #ContagiousInterview, #ITWorker https://www.wired.com/story/a-security-pro-hacked-north-korean-hackers-he-found-theyd-breached-hundreds-of-networks-worldwide/
"Latest Contagious Interview malware campaign abuses Microsoft VSCode Tasks" published by OSM. #ContagiousInterview, #Lazarus, #DPRK, #CTI https://opensourcemalware.com/blog/contagious-interview-vscode
December 3, 2025 at 3:30 PM
"Latest Contagious Interview malware campaign abuses Microsoft VSCode Tasks" published by OSM. #ContagiousInterview, #Lazarus, #DPRK, #CTI https://opensourcemalware.com/blog/contagious-interview-vscode
"DPRK's Contagious Interview campaign is still running" published by Moonlock. #macOS, #ContagiousInterview, #OtterCookie https://x.com/moonlock_lab/status/2088333062153138563
DPRK's Contagious Interview campaign is still running
x.com
August 18, 2026 at 12:48 AM
"DPRK's Contagious Interview campaign is still running" published by Moonlock. #macOS, #ContagiousInterview, #OtterCookie https://x.com/moonlock_lab/status/2088333062153138563
"“Contagious Interview” Targets macOS with FlexibleFerret Malware" published by HivePro. #ContagiousInterview, #FlexibleFerret, #DPRK, #CTI https://hivepro.com/wp-content/uploads/2025/02/TA2025031.pdf
February 9, 2025 at 3:30 PM
"“Contagious Interview” Targets macOS with FlexibleFerret Malware" published by HivePro. #ContagiousInterview, #FlexibleFerret, #DPRK, #CTI https://hivepro.com/wp-content/uploads/2025/02/TA2025031.pdf
"ClickFix, EtherHiding & a DPRK Wallet Trail" published by Allsecure. #ContagiousInterview, #ClickFix, #UNC5342, #EtherHiding https://www.allsecure.io/blog/clickfix-etherhiding-dprk-wallet
ClickFix, EtherHiding & a DPRK Wallet Trail
www.allsecure.io
July 30, 2026 at 11:55 PM
"ClickFix, EtherHiding & a DPRK Wallet Trail" published by Allsecure. #ContagiousInterview, #ClickFix, #UNC5342, #EtherHiding https://www.allsecure.io/blog/clickfix-etherhiding-dprk-wallet
"FlexibleFerret: macOS Malware Deploys in Fake Job Scams" published by Jamf. #FlexibleFerret, #ContagiousInterview, #DPRK, #CTI https://www.jamf.com/blog/flexibleferret-malware-continues-to-adapt/
November 25, 2025 at 11:30 PM
"FlexibleFerret: macOS Malware Deploys in Fake Job Scams" published by Jamf. #FlexibleFerret, #ContagiousInterview, #DPRK, #CTI https://www.jamf.com/blog/flexibleferret-malware-continues-to-adapt/
"Infostealer malware linked to Lazarus Group campaigns" published by RayssaCardoso. #ClickFix, #ContagiousInterview, #Lazarus, #DPRK, #CTI https://medium.com/@rayssac/infostealer-malware-linked-to-lazarus-group-campaigns-a510ad5f3e4f
February 9, 2025 at 3:30 PM
"Infostealer malware linked to Lazarus Group campaigns" published by RayssaCardoso. #ClickFix, #ContagiousInterview, #Lazarus, #DPRK, #CTI https://medium.com/@rayssac/infostealer-malware-linked-to-lazarus-group-campaigns-a510ad5f3e4f
"Fake Jobs, Real Malware. Uncovering How Cybercriminals are Exploiting the Employment Market" published by Bitdefender. #ContagiousInterview, #Lazarus, #Youtube, #DPRK, #CTI https://www.youtube.com/watch?v=r-rChSE8-VA
October 28, 2025 at 1:30 PM
"Fake Jobs, Real Malware. Uncovering How Cybercriminals are Exploiting the Employment Market" published by Bitdefender. #ContagiousInterview, #Lazarus, #Youtube, #DPRK, #CTI https://www.youtube.com/watch?v=r-rChSE8-VA
"Heads up all—some dudes have a slick, new way of dropping some nasty malware" published by Tay. #ContagiousInterview, #Lazarus, #DPRK, #CTI https://archive.md/Av5vp
December 29, 2024 at 1:30 PM
"Heads up all—some dudes have a slick, new way of dropping some nasty malware" published by Tay. #ContagiousInterview, #Lazarus, #DPRK, #CTI https://archive.md/Av5vp
Fake recruiter and collaborator offers are targeting Rust developers, tricking them into running malicious code or sharing credentials. The campaign is tied to Contagious Interview, linked to North Korean operators. #Rust #WaterPlum #NorthKorea
North Korea’s Job Interview Scam Runs Both Ways
Rust Project maintainers and crate developers are being targeted by attackers who pose as recruiters or collaborators to trick victims into running malicious code or revealing credentials. The campaign is linked to Contagious Interview (aka WaterPlum), a North Korean operation that has compromised thousands of devices and cryptocurrency wallets worldwide. #RustProject #ContagiousInterview #WaterPlum #cratesio
www.hendryadrian.com
September 21, 2026 at 1:15 PM
Fake recruiter and collaborator offers are targeting Rust developers, tricking them into running malicious code or sharing credentials. The campaign is tied to Contagious Interview, linked to North Korean operators. #Rust #WaterPlum #NorthKorea