ContagiousInterview

Description

ContagiousInterview is a JavaScript based downloader associated with North Korean threat actors that delivers additional malware payloads through fake interview processes. The scheme targets job seekers, often freelancers in software development, by presenting a coding assessment that prompts the victim to install or run malicious code. The delivered tooling harvests credentials, and some variants grant operators access to the victim's camera and files through staged components.

Stats

First seen

December 2025

Last seen

October 2026

Alert name variants

References

• malpedia.caad.fkie.fraunhofer.de →
• attack.mitre.org →