Validin Contagious Interview North Korea ClickFix January 2025

Contagious Interview has leveraged ClickFix type tactics enticing victims to copy and paste malicious code.

Contagious Interview has relied on users to install a malicious library from a code repository to infect the victim's device and has led to additional payload distribution and theft of sensitive data.

Contagious Interview has used fake job advertisements and messages sent via social media to spearphish targets. Contagious Interview has also leveraged hiring websites to solicit victims.

Contagious Interview has registered domains to leverage in their social engineering campaigns. Contagious Interview has also registered domains to utilize for C2.

Contagious Interview has created and maintained personas on code repositories to distribute malicious payloads.

Contagious Interview developed malicious NPM packages for delivery to or retrieval by victims.

Contagious Interview had identified and solicited victims through social media such as LinkedIn, X, and Telegram.

Contagious Interview has hosted malicious payloads on code repositories used as lures for victims to download.

Contagious Interview had impersonated HR hiring personnel through social media, job board notifications, and conducted interviews with victims in order to entice them to download malware disguised as legitimate applications or malicious scripts from code repositories.