Socket HexEval BeaverTail Contagious Interview June 2025

HexEval Loader has leveraged server-side client configurations to identify the public IP of the victim host.

HexEval Loader has encoded module names and C2 URLs as hexadecimal strings in attempts to evade analysis.

HexEval Loader has collected the username from the victim host.

HexEval Loader has masqueraded and typosquatted as legitimate code repository packages and projects.

HexEval Loader has exfiltrated victim data using HTTPS POST requests to its C2 servers.

Contagious Interview has exfiltrated data from a compromised host to actor-controlled C2 servers.

HexEval Loader has utilized a cross-platform keylogger that has the capability to capture keystrokes on Windows, macOS and Linux systems.

HexEval Loader has executed malicious JavaScript code.

HexEval Loader has used HTTP and HTTPS POST requests to communicate with C2.

HexEval Loader has identified the OS and MAC address of victim device through host fingerprinting scripting.

BeaverTail has searched for .ldb and .log files stored in browser extension directories for collection and exfiltration.

BeaverTail has been used to download a malicious payload to include Python based malware InvisibleFerret.

HexEval Loader has been used to download a malicious payload to include BeaverTail.

HexEval Loader has decoded its payload prior to execution.

Contagious Interview has relied on users to install a malicious library from a code repository to infect the victim's device and has led to additional payload distribution and theft of sensitive data.

BeaverTail has searched the victim device for browser extensions including those commonly associated with cryptocurrency wallets.

Contagious Interview has configured C2 endpoints to review IP geolocation, request headers, victim environment details and runtime conditions prior to delivering payloads.

Contagious Interview has requested victims to disable Docker and other container environments in attempts to thwart container isolation and ensure device infection.

Contagious Interview has leveraged malware variants configured to dump credentials from the macOS keychain.

BeaverTail has collected keys associated with macOS within `/Library/Keychains/login.keychain`.

BeaverTail has stolen passwords saved in web browsers. BeaverTail has also been known to collect login data from Firefox within key3.db, key4.db and logins.json from `/.mozilla/firefox/` for exfiltration.

Contagious Interview has registered domains to leverage in their social engineering campaigns. Contagious Interview has also registered domains to utilize for C2.

Contagious Interview has used web services such as Dropbox to receive stolen data and Google Drive, Firebase, GitHub, and Telegram to disseminate files. Contagious Interview has also used a cloud platform such as Vercel for C2 operations leveraging malicious web applications and static pages. Contagious Interview has also used Slack to coordinate their activities.

Contagious Interview has created and maintained personas on code repositories to distribute malicious payloads.

Contagious Interview has created fake email accounts to correspond with social media accounts, fake LinkedIn personas, code repository accounts, and job announcements on development job board services. Contagious Interview has also utilized fake email accounts with Threat Intelligence vendor services.

Contagious Interview developed malicious NPM packages for delivery to or retrieval by victims.

Contagious Interview has researched specific professional groups such as software developers for targeting. Contagious Interview has also researched individuals who work in roles related to cryptocurrency and blockchain technologies.

Contagious Interview has hosted malicious payloads on code repositories used as lures for victims to download.

HexEval Loader has a function where the C2 endpoint can identify the geographical location of a victim host based on request headers, execution environment and runtime conditions.

Contagious Interview has stolen cryptocurrency wallet credentials and credit card information utilizing BeaverTail and InvisibleFerret malware.

Contagious Interview had impersonated HR hiring personnel through social media, job board notifications, and conducted interviews with victims in order to entice them to download malware disguised as legitimate applications or malicious scripts from code repositories.

Contagious Interview has convinced victims to disable Docker and other container environments and run code on their machine natively in attempts to bypass container isolation and ensure device infection.