Contagious Interview is a North Korea–aligned threat group known for cyberespionage and financially motivated operations using fake job interviews.
Contagious Interview is a North Korea–aligned threat group active since 2023, conducting cyberespionage and financially motivated operations. The group primarily targets individuals in software development and cryptocurrency sectors. Key TTPs include spearphishing via fake job interviews on platforms like LinkedIn, deploying malicious libraries (BeaverTail, InvisibleFerret malware), and using keychain phishing on macOS. Defenders should focus on suspicious files downloaded from code repositories during recruitment processes, C2 traffic over non-standard ports, and autostart entry modifications on macOS/Linux systems.
Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.
Monitor for search activities in code repositories.
Monitor for suspicious new Web service and account creation activities.
Monitor email and other messaging platforms for spearphishing attempts via service.
Monitor for suspicious library loading activities.
Monitor for XDG Autostart Entries modifications.
Monitor for Unix Shell Configuration file modifications.
Monitor for suspicious process names and masquerading of legitimate processes.
Monitor Keychain access and watch for suspicious activities.
Monitor for system information and file directory discovery activities.
Monitor Remote Desktop Software activities using non-standard ports.
Monitor for suspicious data exfiltration over Web services.
Monitor for disabling or modifying security tools.
Monitor for suspicious transactions that could lead to financial theft.
Contagious Interview primarily targets individuals engaged in software development and cryptocurrency-related activities.
Malware used by the Contagious Interview group includes BeaverTail, InvisibleFerret, and keychain phishing on macOS.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.