Disrupting_Contagious_Interview.pdf (16 MB)

Atlassian attributes Contagious Interview with high confidence to North Korea's Famous Chollima group, citing job-lure tradecraft, BeaverTail, OtterCookie and InvisibleFerret use, infrastructure overlap, and Astrill VPN activity. Hundreds of malicious repositories used large reusable codebases to conceal loaders triggered through obfuscated JavaScript, npm scripts and packages, VS Code tasks, Git hooks, fake fonts, or SVG files. The infection chain can also include PylangGhost and GolangGhost, with capabilities ranging from credential and wallet theft to persistence and additional payload execution.