hacker-news Sep 21, 2026 · Crawled Sep 21, 2026

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

1 IoCs 1 Actors 7 Malware

AI Summary

North Korean threat actors associated with the Contagious Interview campaign have compromised over 30,000 devices across more than 100 countries since at least 2022, targeting software developers and IT professionals in cryptocurrency, blockchain, and Web3 sectors. The attackers pose as recruiters on platforms like LinkedIn, offering fake job opportunities that lead to multi-stage malware infections. Malware families deployed include BeaverTail, InvisibleFerret, and RATatouille, enabling credential theft, cryptocurrency theft, and lateral movement into corporate networks. A related operation uses Western proxies recruited via Discord to bypass sanctions and identity checks, with North Korean IT workers using AI-generated identities to secure remote jobs and steal funds.

AI-extracted · verify before operational use

Extracted Entities 8 found

Threat Actor WageMole → Malware Beavertail → Malware InvisibleFerret → Malware FlexibleFerret → Malware PylangGhost → Malware OtterCookie → Malware OtterCandy → Malware StoatWaffle →

Indicators of Compromise 1 extracted

Type	Value	Detail
Domain	mouse-review[.]discord[.]gg	Details →

MITRE ATT&CK TTPs 30 techniques

T1005 Data from Local System · Collection T1021.003 Distributed Component Object Model · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1055 Process Injection · Defense Evasion T1056.001 Keylogging · Collection T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1071.003 Mail Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1105 Ingress Tool Transfer · Command And Control T1113 Screen Capture · Collection T1114 Email Collection · Collection T1123 Audio Capture · Collection T1133 External Remote Services · Persistence T1204.002 Malicious File · Execution T1482 Domain Trust Discovery · Discovery T1490 Inhibit System Recovery · Impact T1555 Credentials from Password Stores · Credential Access T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access T1573 Encrypted Channel · Command And Control T1003 OS Credential Dumping · Credential Access T1056.002 GUI Input Capture · Collection T1059.007 JavaScript · Execution T1195.002 Compromise Software Supply Chain · Initial Access T1110 Brute Force · Credential Access