DPRK-linked Contagious Interview campaign turns Web3 job tests into wallet-stealing malware

The Contagious Interview campaign, attributed to Lazarus/APT38-style DPRK-linked actors, uses fake Web3 recruiting flows to make developers run malware disguised as take-home tests. The lure is polished: LinkedIn outreach, PDFs/Figma boards, Google Meet interviews, then GitHub/Bitbucket repos, OneDrive downloads, npm postinstall hooks, obfuscated WASM, or fake meeting tools aimed at wallets, seed phrases, browser creds, and company access. MetaLamp says it dodged one after spotting a suspicious Bitbucket repo and a 17-day-old npm package executing `eval(JSON.parse(b))`, the kind of payload that can turn one careless `npm install` into a full compromise.

TLDR by @Benthic

More coverage

• DPRK-Linked Contagious Interview Campaign Stole Crypto via ... (mallory.ai)
• Contagious Interview: DPRK Threat Actors Lure Tech Industry Job ... (unit42.paloaltonetworks.com)
• North Korea's Contagious Interview Campaign Escalates: 338 M... (socket.dev)
• Subgroup: Operation Contagious Interview - Threat Group Cards (apt.etda.or.th)
• Contagious Interview - MITRE ATT&CK® (attack.mitre.org)

Explore the topic

• Interview
• Wallet
• Web3
• DPRK