Contagious Interview Threat Actor Profile Guide: Fake Coding Tests, BeaverTail and Defences

Contagious Interview turns the hiring process into a malware delivery channel: fake recruiters ask software developers to run a coding test, and the test installs an infostealer and backdoor that empty crypto wallets and harvest developer credentials. This profile is built from MITRE ATT&CK v20 (group G1052 and software S1246 and S1245), the FBI public service announcement I-090324-PSA, and published research by Palo Alto Networks Unit 42, ESET, Socket and Silent Push. It covers names, targeting, ATT&CK techniques, why developer tokens and keys are often the real prize, and detection and hardening. It is for security operations, developer platform and identity teams, and for anyone who runs technical hiring. It names no individuals.

Key takeaways

• The lure is a job, the payload is a repository. Victims are asked to clone a project or install an npm package as part of an interview; running npm install or starting the project executes the malware.
• Two stages, three operating systems. BeaverTail (JavaScript or Qt/C++) steals browser logins and wallet data and downloads InvisibleFerret, a modular Python backdoor that adds keylogging, file theft and AnyDesk remote access on Windows, Linux and macOS.
• Developer secrets are the second prize. A developer laptop holds SSH keys, cloud CLI credentials, package publishing tokens and browser sessions, so one infected interview can become a supply chain or cloud incident.
• The registry is now a delivery channel at scale. Socket counted more than 338 malicious npm packages with over 50,000 downloads in the three months to October 2025, using typosquats of common libraries and loaders called HexEval and XORIndex.
• Isolation beats awareness alone. The FBI's core advice is to never run pre-employment code on a company device; give developers a disposable environment, block install scripts by default and watch for traffic on non-standard ports such as 1224.

Who they are (names and aliases)

MITRE ATT&CK v20 tracks the activity as group Contagious Interview (G1052), a North Korea aligned group active since 2023 that conducts both espionage and financially motivated operations, including theft of cryptocurrency and credentials. Palo Alto Networks Unit 42 named the campaign in November 2023 as CL-STA-0240, with infrastructure dating to about December 2022, and attributed it to North Korea with moderate confidence. ESET tracks an overlapping cluster as DeceptiveDevelopment, assesses it as North Korea aligned with high confidence, and notes technique similarities with Moonstone Sleet and the Lazarus DreamJob and DangerousPassword campaigns without attributing it to a known actor.

Not the same as fake IT workers. Unit 42's original report described a twin campaign, Wagemole (CL-STA-0241), in which North Korean applicants seek jobs at Western companies. Contagious Interview is the reverse: the attacker plays the employer and the victim is the candidate. The defences differ, so read the Fake IT Workers Guide for the applicant side and the Lazarus Group Threat Actor Profile for the wider North Korean picture.

Targeting and motivation

The group focuses on individuals in software development and cryptocurrency work. The FBI's September 2024 announcement describes North Korean actors studying employees of DeFi and cryptocurrency firms on professional networking and job platforms, building rapport over long conversations, often in fluent English, and posing as recruiters or known contacts before asking for a "pre-employment test" or debugging exercise.

• Contact channels: ESET lists LinkedIn, Upwork, Freelancer.com, We Work Remotely, Moonlight and Crypto Jobs List; ATT&CK adds X, Telegram and code repository sites such as GitHub.
• Personas and front companies: Socket counted more than 180 fake personas in one npm wave. Silent Push documented three front companies, BlockNovas LLC, Angeloper Agency and SoftGlide LLC, with AI-generated employee profiles. ATT&CK records the group's use of AI for images and content (T1588.007) and its cloning of video-conferencing apps.
• Motivation: mainly financial (wallet theft, payment card data), with persistent access that can support espionage or follow-on intrusion into the employer of a victim who used a work laptop.
• Who is exposed: freelance and contract developers, Web3 engineers and anyone who takes interviews on a corporate device, which Unit 42 warns exposes employer data.

Tactics and techniques (MITRE ATT&CK)

All IDs below are from ATT&CK v20 entries for G1052, S1246 and S1245. Behaviour descriptions summarise the ATT&CK procedure examples and the vendor reports.

How the lure has evolved: Unit 42's 2023 report described an npm package hosted on GitHub, with victims first told to install VS Code, Git and Node.js. In October 2024 Unit 42 reported fake MiroTalk and FreeConference installers and a Qt-based BeaverTail compiled for Windows and macOS from at least July 2024, targeting 13 wallet extensions. ESET reported malicious code appended after a long comment so it sits off-screen in editors without word wrap, and later InvisibleFerret versions targeting 88 browser extensions. Socket's 2025 waves moved the payload into the public npm registry using typosquats such as epxreso, dotevn, vaildator and ethrs.js, with newer loaders hiding AES-encrypted code in a file named LICENSE. It also checks threat intelligence services for reporting on its own indicators (T1681), so expect fast rotation.

How they abuse identities and credentials

Wallets make headlines, but for an organisation the larger risk is what else sits on a developer's machine. Every item below is a non-human or workload credential that outlives the interview.

• Browser sessions and saved passwords: BeaverTail and the InvisibleFerret browser module take saved logins, autofill and cookies from Chromium browsers and Firefox. A stolen session cookie for a source host, cloud console or SSO portal can bypass MFA. See the Infostealer Threat Guide.
• Password manager extensions and keychain: ATT&CK records theft from password manager extensions (T1555.005) and the macOS login keychain (T1555.001). If the vault is unlocked, every stored credential is exposed.
• Package publishing tokens: an .npmrc with a publish token turns a victim into a distribution point for the next wave. See the npm Tokens Security Guide.
• Source host tokens and SSH keys: personal access tokens and SSH keys give push access to private repositories and CI workflows. See the GitHub Personal Access Tokens Security Guide.
• Cloud CLI credentials: long-lived access keys and cached session tokens in developer profiles reach production directly. The Bybit Hack 2025: How One Developer's AWS Session Tokens Enabled a $1.5 Billion Theft, attributed by the FBI to a different North Korean cluster (TraderTraitor) after a developer ran a malicious Docker project, showed how far one developer's AWS session tokens can reach once a workstation is compromised.
• Attacker-controlled remote access: ESET found the AnyDesk module installs AnyDesk with hardcoded credentials, the only persistence in the chain it studied. That is an unmanaged remote access identity on your endpoint. See the RMM Tool Security Guide.
• Attacker identities on your platforms: fake personas, front companies and throwaway publisher accounts are themselves identities. Socket urges registries to revoke publisher tokens, not just remove packages.

Notable incidents

The sources name no victims; these milestones describe the operation.

• November 2023, campaign named: Unit 42 publishes the first report on Contagious Interview and Wagemole, with BeaverTail and InvisibleFerret delivered through npm packages hosted on GitHub.
• September 2024, FBI warning: I-090324-PSA warns that North Korea is aggressively targeting the crypto industry with fake employment and pre-employment tests, and lists indicators and mitigations.
• October 2024, cross-platform rewrite: Unit 42 reports Qt-based BeaverTail and fake video-conferencing installers for Windows and macOS.
• February 2025, freelance platforms: ESET documents DeceptiveDevelopment on freelance and crypto job sites, with trojanised projects on GitHub, GitLab and Bitbucket.
• July to October 2025, npm flood: Socket tracks more than 338 malicious packages and over 50,000 downloads, with 25 still live at the time of its report.

Detection and defence

What to log and hunt

Hardening, in priority order

1. Separate interviews from work: policy and technical control that no candidate or contractor test runs on a corporate device, as the FBI and Unit 42 advise. Provide a disposable VM or cloud development environment with no corporate credentials and no route to internal networks. See the Sandboxing and Code Execution Guide.
2. Block install-time execution by default: set npm's ignore-scripts option on developer machines and CI, route installs through an internal registry or package firewall, and pin versions with lockfiles. See the Malicious Package and Dependency Confusion Guide.
3. Shrink what a stolen laptop holds: short-lived cloud credentials through SSO, hardware-backed SSH keys, fine-grained and expiring repository and npm tokens, and no wallet keys or seed phrases on internet-connected devices.
4. Control remote access tools and egress: allow one approved remote support tool and block others with application control; restrict developer egress to known registries and services. See the Application Allowlisting Guide.
5. Brief the people being targeted: developers, recruiters and Web3 staff should know the FBI indicators: unusual pay with no negotiation, insistence on custom video software, scripts to "unlock" camera features, pressure to move to other messaging apps, and requests to disable Docker.
6. Plan the response: if a test was run on a work device, isolate it, then revoke and reissue every token, key and session it held before reimaging. See the Leaked Credential Response Playbook.

Rollout and testing: enable ignore-scripts and package firewall rules in report-only mode for two to four weeks to find builds that genuinely need install scripts, add explicit exceptions, then enforce for one team before the rest. Keep a per-repository rollback. Test detections with an authorised emulation of a Node.js process spawning Python and connecting to a high port.

Small versus large organisations: small teams get most value from a no-interviews-on-work-devices rule, a managed EDR, short-lived cloud credentials and npm ignore-scripts. Larger estates add an internal registry with malware scanning, cloud development environments for untrusted code, and identity threat detection on token use from new devices.

Metrics

• Developer endpoints and CI runners with install scripts blocked by default (percentage).
• Percentage of cloud and repository access using short-lived credentials rather than long-lived keys or tokens.
• Number of unapproved remote access tools detected per month, and time to remove them.
• Time from suspected infection to revocation of all credentials held on the device.
• Blocked typosquat or malicious package installs per month at the package firewall.

Framework mapping

Practitioner checklist

• Publish and enforce a rule that interview and freelance test code never runs on corporate devices.
• Provide a disposable, credential-free environment for reviewing untrusted repositories.
• Set npm ignore-scripts by default and route installs through a scanned internal registry.
• Alert on Node.js processes spawning Python or shells and on developer traffic to ports 1224, 1244, 2245 and 8637.
• Block unapproved remote access tools, including AnyDesk where it is not your standard.
• Move developers to short-lived cloud credentials, expiring fine-grained tokens and hardware-backed SSH keys.
• Keep wallet keys and seed phrases off internet-connected developer machines.
• Write a response runbook that revokes every token, key and session on an affected device before reimaging.

Standards and references

• MITRE ATT&CK: Contagious Interview (G1052)
• MITRE ATT&CK: BeaverTail (S1246)
• MITRE ATT&CK: InvisibleFerret (S1245)
• FBI: North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks (I-090324-PSA)
• Palo Alto Networks Unit 42: Hacking Employers and Seeking Employment: Two Job-Related Campaigns
• Palo Alto Networks Unit 42: Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers
• ESET: DeceptiveDevelopment targets freelance developers
• Socket: North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages

Related NHI Mgmt Group resources: Lazarus Group Threat Actor Profile · Fake IT Workers Guide · Threat Actor Groups Guide · Crypto Wallet Security Guide · ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide