North Korea ‘Contagious Interview’ uses JSON malware channels
Category:Threat Actors & Campaigns
North Korea’s “Contagious Interview” campaign now leverages JSON storage services as covert malware delivery channels to target developers and engineers with job-themed lures. Threat actors posing as recruiters on LinkedIn and similar platforms invite victims to collaborate on technical projects or complete assessments, then direct them to download trojanized repositories from GitHub, GitLab or Bitbucket. Inside these projects, configuration files such as server/config/.config.env contain Base64-encoded values posing as API keys but actually embedding URLs to JSON Keeper, JSONsilo or npoint.io, where obfuscated second-stage payloads are stored. This tradecraft maps to T1566 (Phishing), T1204 (User Execution) and T1105 (Ingress Tool Transfer) as adversaries blend social engineering with developer tooling. The retrieved payloads often include BeaverTail, a JavaScript infostealer that harvests browser data, credentials and crypto wallet information, and InvisibleFerret, a Python backdoor providing persistence and command execution. Recent analyses show the toolkit has evolved to fetch an additional module dubbed TsunamiKit from Pastebin, supporting system fingerprinting, staged data collection and retrieval of more malware from a Tor .onion service. By staging payloads on legitimate JSON hosting services and popular code platforms, the operators significantly increase their chances of bypassing URL filters and domain reputation systems, while TLS and JSON formats blend into ordinary developer traffic. These techniques align with T1027 (Obfuscated Files or Information) and T1041 (Exfiltration Over C2 Channel) in a campaign designed for stealth and resilience. From a business perspective, Contagious Interview directly targets organizations that depend on software supply chains, cloud-native applications and internal developer tooling. Compromised developer workstations and CI/CD accounts can quickly lead to source code theft, embedded backdoors in products and downstream supply chain compromise similar to previous high-profile incidents. When stolen credentials or code repositories include customer or payment data, organizations may face GDPR or industry-specific breach notification requirements even if production systems are not immediately ransomed. Defenders should treat unsolicited interview or collaboration invitations that require downloading code as high-risk, especially when they originate from free-mail or newly created domains. Enterprises should implement application allowlisting for development tools, inspect build pipelines for unusual external JSON fetches and monitor for outbound connections to JSON Keeper, JSONsilo, npoint.io and Pastebin in developer segments. Security awareness training for engineers should emphasize campaign-specific lures such as Contagious Interview, while endpoint detection and response tools should be tuned to identify BeaverTail, InvisibleFerret, TsunamiKit and related TTPs in source code and local execution traces.
CORTEX Protocol Intelligence Assessment
Business Impact: The Contagious Interview campaign threatens organizations through their software development workforce, creating a direct path from individual developer compromise to source code theft, CI/CD pipeline abuse and downstream supply chain attacks. Successful intrusions can expose intellectual property, sensitive configuration secrets and customer data, with potential regulatory and contractual penalties when compromised code reaches production. Technical Context: North Korean operators combine T1566 phishing lures with trojanized repositories and JSON-based payload staging that uses JSON Keeper, JSONsilo, npoint.io and Pastebin as covert C2 and malware delivery points. Their toolset of BeaverTail, InvisibleFerret and TsunamiKit exemplifies T1105, T1027 and T1041, highlighting the need for network monitoring of developer environments, domain controls for code hosting platforms and strict guardrails around third-party project use.
Strategic Intelligence Guidance
- Apply strict controls on downloading and executing code from unsolicited GitHub, GitLab or Bitbucket projects, especially when delivered via job or recruiter outreach on LinkedIn.
- Instrument developer networks and proxies to log and alert on outbound traffic to JSON Keeper, JSONsilo, npoint.io and Pastebin, correlating requests with suspicious repositories.
- Harden CI/CD and developer identities with MFA, FIDO tokens and least privilege access so stolen credentials from BeaverTail or InvisibleFerret cannot easily pivot into production.
- Incorporate Contagious Interview tradecraft into security awareness and red team exercises focused on engineering staff, validating that detection and response processes cover these TTPs.
Vendors
Threats
Targets
Intelligence Source: North Korea ‘Contagious Interview’ uses JSON malware channels | Nov 15, 2025