lazarusholic

Everyday is lazarus.dayβ

#ContagiousInterview

Operation/Campaign

Reports

2026-06-16
ESTSecurity
Chai.js 플러그인으로 위장한 북한발 npm 악성 패키지 'chai-as-init' 분석
#ContagiousInterview #NPM
2026-06-08
Proofpoint
Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency
#ContagiousInterview #UNK_DeadDrop
2026-05-31
Socket
Famous Chollima Targets PHP Developers Through Compromised Packagist Package
#ContagiousInterview #FamousChollima
2026-05-25
Denv
I was likely targeted by DPRK in a sophisticated developer malware campaign
#ContagiousInterview #VSCode
2026-05-18
meowmfer
Deep Dive into Active Github Network Running Contagious Interview
#ContagiousInterview #BeaverTail #OmniStealer
2026-05-05
OSM
Lazarus Group Uses Git Hooks To Hide Malware
#ContagiousInterview #Lazarus #TasksJacker
2026-04-30
Domaintools
DPRK Contagious Interview: Developer Workflow Compromise
#ContagiousInterview #Lazarus
2026-04-23
Turshija
I got completely owned by the most sophisticated hack I've ever encountered
#ContagiousInterview
2026-04-07
Socket
North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads
#ContagiousInterview
2026-04-02
SafeDep
Malicious npm Package express-session-js Drops Full RAT Payload
#ContagiousInterview #NPM
2026-04-01
BreakGlassIntelligence
Two IOCs In, Five C2 Servers Out: Mapping DPRK's Contagious Interview Campaign From InvisibleFerret to a Kimsuky Crossover
#ClickFix #ContagiousInterview #InvisibleFerret #Kimsuky
2026-03-23
Sophos
NICKEL ALLEY strategy: Fake it ‘til you make it
#NickelAlley #ClickFix #ContagiousInterview #PylangGhost
2026-03-17
NTTSecurity
StoatWaffle, malware used by WaterPlum
#ContagiousInterview #StoatWaffle #VSCode #WaterPlum
2026-03-17
NTTSecurity
WaterPlumが使用するマルウェアStoatWaffleについて
#ContagiousInterview #StoatWaffle #VSCode #WaterPlum
2026-03-11
Microsoft
Contagious Interview: Malware delivered through fake developer job interviews
#ContagiousInterview #InvisibleFerret #OtterCookie #VSCode
2026-03-09
SerapHim
Contagious Interview Campaign: Independent Analysis of the StegaBin Wave
#ContagiousInterview #FamousChollima #StegaBin
2026-03-09
AbstractSecurity
Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains Part 2
#ContagiousInterview #VSCode #GolangGhost #PylangGhost
2026-03-08
OSM
PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos
#BeaverTail #ContagiousInterview #NPM #PolinRider #VSCode #GitHub
2026-03-05
Allsecure
North Korea Tried to Hack Our CEO Through a Fake Job Interview on LinkedIn
#BeaverTail #ContagiousInterview #Lazarus #VSCode
2026-02-27
Socket
StegaBin: 26 Malicious npm Packages Use Pastebin Steganograp...
#ContagiousInterview #FamousChollima #NPM #Steganography #StegaBin
2026-02-26
ENKI
Contagious Interview Campaign Abusing VSCode Distributed on Github
#ContagiousInterview #VSCode
2026-02-26
ENKI
Github를 통해 유포된 VSCode 악용 Contagious Interview 캠페인
#ContagiousInterview #VSCode
2026-02-25
AbstractSecurity
Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains - Part 1
#ContagiousInterview #VSCode
2026-02-20
SecurityConversations
GitLab doxxes North Korea .gov hackers; fresh Ivanti zero-days; AI addiction and human purpose
#ContagiousInterview #ITWorker #Podcast
2026-02-19
Gitlab
GitLab Threat Intelligence Team reveals North Korean tradecraft
#ContagiousInterview #ITWorker
2026-02-15
unpacker
Beyond the Backdoor: How Contagious Interview Is Surgically Tampering with MetaMask Wallets
#BeaverTail #ContagiousInterview #InvisibleFerret #NPM
2026-02-12
BoringSecurity
Famous Chollima and Dragon Sickness
#ContagiousInterview #FamousChollima #VSCode
2026-02-04
PaloaltoNetworks
CONTAGIOUS INTERVIEW CAMPAIGN ACTIVITY
#ContagiousInterview
2026-02-03
RedAsgard
Hunting Lazarus Part IV: Real Blood on the Wire
#ContagiousInterview #Lazarus
2026-01-28
OSM
New DPRK Contagious Interview Campaign: “Fake Font” Uses Malicious VSCode Fonts
#ContagiousInterview #FakeFont #VSCode
2026-01-26
OSM
Small Open-Source Maintainers Targeted by VS Code Tasks Malware
#ContagiousInterview #VSCode
2026-01-21
RecordedFuture
PurpleBravo’s Targeting of the IT Software Supply Chain
#BeaverTail #ClickFix #ContagiousInterview #GolangGhost #PurpleBravo #PylangGhost
2026-01-20
AbstractSecurity
Contagious Interview: Tracking the VS Code Tasks Infection Vector
#ContagiousInterview #VSCode
2026-01-20
OSM
Contagious Interview gets an upgrade for 2026
#ContagiousInterview #Lazarus
2026-01-20
Jamf
Threat Actors Expand Abuse of Microsoft Visual Studio Code
#ContagiousInterview #VSCode
2026-01-14
OZ
How to Get Scammed (by DPRK Hackers)
#ContagiousInterview #DevPopper
2026-01-13
SecurityAlliance
VS Code Tasks Abuse by Contagious Interview (DPRK)
#ContagiousInterview
2026-01-12
RedAsgard
Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure
#ContagiousInterview #Lazarus
2025-12-23
OSM
New DPRK Malware Uses Microsoft VSCode Dictionary Files
#ContagiousInterview #VSCode
2025-12-10
Flashpoint
Beyond the Malware: Inside the Digital Empire of a North Korean Threat Actor
#ContagiousInterview
2025-11-29
OSM
Latest Contagious Interview malware campaign abuses Microsoft VSCode Tasks
#ContagiousInterview #Lazarus #VSCode
2025-11-26
Socket
Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks
#ContagiousInterview #NPM #OtterCookie
2025-11-25
Jamf
FlexibleFerret: macOS Malware Deploys in Fake Job Scams
#FlexibleFerret #ContagiousInterview
2025-11-23
L0Psec
DPRK Contagious Interview Lure - Go Backdoor & Swift App
#ContagiousInterview #Youtube
2025-11-23
L0Psec
More active DPRK macOS malware "Contagious Interview"
#ContagiousInterview
2025-11-20
Validin
Inside DPRK's Fake Job Platform Targeting U.S. AI Talent
#ClickFix #ContagiousInterview
2025-11-13
NVISO
Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery
#ContagiousInterview #InvisibleFerret
2025-10-21
Bitdefender
Fake Jobs, Real Malware. Uncovering How Cybercriminals are Exploiting the Employment Market
#ContagiousInterview #Lazarus #Youtube
2025-10-21
KL4R10N
Beyond eval(): DPRK’s New Malware Strategy Hidden in Job Assignments
#ContagiousInterview #NPM
2025-10-19
MITRE
Contagious Interview
#ContagiousInterview #G1052
2025-10-15
NTTSecurity
WaterPlumが使用するマルウェアOtterCandyについて
#ContagiousInterview #OtterCandy #WaterPlum
2025-10-15
NTTSecurity
OtterCandy, malware used by WaterPlum
#ContagiousInterview #OtterCandy #WaterPlum
2025-10-10
Socket
North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads
#ContagiousInterview #NPM
2025-09-10
AnyRun
Lazarus Group Attacks in 2025: Overview for SOC Teams
#ContagiousInterview #ITWorker #InvisibleFerret #Lazarus #OtterCookie #PylangGhost
2025-09-04
SentinelOne
North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms
#ClickFix #ContagiousInterview
2025-08-27
Anthropic
Detecting and countering misuse of AI: August 2025
#ITWorker #ContagiousInterview #FamousChollima
2025-07-26
Bloo
InvisibleFerret Threat Intelligence Report
#ContagiousInterview #InvisibleFerret
2025-07-15
Socket
Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader
#ContagiousInterview #NPM #XORIndex
2025-07-01
Proofpoint
Inside North Korea's Global Cyber Playbook
#ContagiousInterview #ITWorker #Podcast #TA427
2025-06-25
Socket
Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages
#BeaverTail #ContagiousInterview #HexEval #NPM
2025-06-25
dazhengzhang
These North Korean phishers just don't stop
#ContagiousInterview
2025-06-13
Nefture
The 2024 Crypto Crime Report
#ContagiousInterview #DMM #Lazarus #RadiantCapital #Whitepaper
2025-05-13
Igloo
북한 위협 행위자 Contagious Interview 캠페인 분석(2보)
#BeaverTail #ContagiousInterview
2025-05-08
NTTSecurity
WaterPlumが使用するマルウェアOtterCookieの機能追加
#OtterCookie #WaterPlum #ContagiousInterview
2025-05-08
NTTSecurity
Additional Features of OtterCookie Malware Used by WaterPlum
#OtterCookie #WaterPlum #ContagiousInterview
2025-04-25
TeamCymru
Now that the cat is out of the bag regarding the use of front companies like BlockNovas LLC
#ContagiousInterview
2025-04-25
HISolutions
Rolling in the Deep(Web): Lazarus Tsunami
#ContagiousInterview #Tsunami
2025-04-24
Silentpush
Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware
#BeaverTail #ContagiousInterview #InvisibleFerret #OtterCookie #FamousChollima #ClickFix
2025-04-11
Bitso
Interview with the Chollima
#ContagiousInterview #OtterCookie #FamousChollima
2025-04-04
Socket
Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads
#BeaverTail #ContagiousInterview #Lazarus #NPM
2025-03-31
SEKOIA
From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic
#ClickFix #ContagiousInterview #GolangGhost #Lazarus #FrostyFerret
2025-03-24
BirminghamCyber
Cómo domar un Chollima
#ChaoticCapybara #VelvetChollima #macOS #ContagiousInterview
2025-03-15
Slowmist
Analysis of LinkedIn Recruitment Phishing
#ContagiousInterview
2025-03-14
Bruno
I just got a scam attempt by a Linkedin "recruiter"
#ContagiousInterview
2025-03-12
dazhengzhang
Another day another North Korean scammer
#ContagiousInterview
2025-03-10
ronxjansen
Npm Run Hack:Me - A Supply Chain Attack Journey
#ContagiousInterview
2025-02-28
Silentpush
Astrill VPN: Silent Push Publicly Releases New IPs on VPN Service Heavily Used by North Korean Threat Actors
#ContagiousInterview #FamousChollima
2025-02-26
PaloaltoNetworks
RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector
#ContagiousInterview #Koi #RustDoor #macOS #AlluringPisces
2025-02-19
Kandji
DPRK DriverEasy & ChromeUpdate Deep Dive
#ContagiousInterview #DriverEasy
2025-02-13
Moonlock
Cybercrooks Are Using Fake Job Listings to Steal Crypto
#ContagiousInterview
2025-02-07
RayssaCardoso
Infostealer malware linked to Lazarus Group campaigns
#ClickFix #ContagiousInterview #Lazarus
2025-02-06
HivePro
“Contagious Interview” Targets macOS with FlexibleFerret Malware
#ContagiousInterview #FlexibleFerret
2025-02-03
Igloo
북한 위협 행위자 Contagious Interview 캠페인 분석
#BeaverTail #ContagiousInterview #OtterCookie
2025-02-03
SentinelOne
macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed
#ContagiousInterview #FlexibleFerret #macOS #FrostyFerret
2025-01-20
ENKI
Lazarus의 Contagious Interview 캠페인 변종 분석
#ContagiousInterview #Lazarus
2025-01-16
Validin
Lazarus APT: Techniques for Hunting Contagious Interview
#ContagiousInterview #Lazarus #ClickFix
2025-01-09
Zeroshadow
DPRK's Willo Impersonation Campaign
#ContagiousInterview
2025-01-05
dmpdump
North Korea-nexus Golang Backdoor/Stealer from Contagious Interview campaign
#ContagiousInterview #GolangGhost
2024-12-28
Tay
Heads up all—some dudes have a slick, new way of dropping some nasty malware
#ContagiousInterview #Lazarus
2024-12-27
Rewterz
Developers Targeted by New ‘OtterCookie’ Malware with Fake Job Offers – Active IOCs
#ContagiousInterview #OtterCookie
2024-12-26
NTTSecurity
OtterCookie, new malware used in Contagious Interview campaign
#ContagiousInterview #OtterCookie
2024-12-26
NTTSecurity
Contagious Interviewが使用する新たなマルウェアOtterCookieについて
#ContagiousInterview #OtterCookie
2024-11-04
Zscaler
From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West
#BeaverTail #ContagiousInterview #InvisibleFerret #Wagemole
2024-11-01
Ketman
Malicious Github Accounts with gh-fake-analyzer
#ContagiousInterview #Lazarus
2024-10-29
Macnica
北からのジョブオファー: ソフトウェア開発者を狙うContagious Interview
#FamousChollima #InvisibleFerret #ContagiousInterview #BeaverTail
2024-10-24
Datadog
Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview
#BeaverTail #ContagiousInterview #TenaciousPungsan
2024-10-09
PaloaltoNetworks
Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware
#BeaverTail #ContagiousInterview #InvisibleFerret
2024-09-04
Group-IB
APT Lazarus: Eager Crypto Beavers, Video calls and Games
#BeaverTail #CivetQ #ContagiousInterview #InvisibleFerret #Lazarus #MiroTalk #FCCCall
2024-08-29
Phylum
North Korea Still Attacking Developers via npm
#ContagiousInterview #MoonstoneSleet #NPM
2024-08-23
Coinmonks
Suspicious activity in GitHub associated with Lazarus Group
#ContagiousInterview #Lazarus
2024-07-21
Coinmonks
Investigating the campaigns of Lazarus Group targeting developers and companies
#ContagiousInterview #Lazarus
2024-05-13
Dimitribest
Lazarus Group Targets Blockchain Developers with Social Engineering and Visual Deception Techniques in Code
#ContagiousInterview
2024-05-10
Qianxin
针对区块链从业者的招聘陷阱：疑似Lazarus（APT-Q-1）窃密行动分析
#APT-Q-1 #ContagiousInterview
2023-11-21
PaloaltoNetworks
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
#InvisibleFerret #ContagiousInterview #Wagemole #BeaverTail #NPM