Threat Actor Unknown origin

Contagious Interview

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.

Indicators of Compromise 7

GitHub Repo 7span/react-list GitHub Repo Artiffusion-Inc/mirofish GitHub Repo Xpos587/git2md GitHub Repo Xpos587/markfetch GitHub User 7span GitHub User Xpos587 Package sevenspan

MITRE ATT&CK TTPs 8

File and Directory Discovery

Domain Trust Discovery

Discovery

T1490

Inhibit System Recovery

Impact

T1555

Credentials from Password Stores

Credential Access

Source Articles

PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems

PolinRider is a North Korea-linked supply chain campaign targeting developer ecosystems, including npm, Packagist, Go modules, and Chrome extensions. The threat actors compromise maintainer accounts, modify legitimate repositories with obfuscated JavaScript loaders, and use Git history rewriting to conceal malicious changes. These loaders retrieve encrypted second-stage payloads from blockchain infrastructure, execute them via eval(), and have delivered malware such as DEV#POPPER and OmniStealer. The campaign remains active, with ongoing compromises across multiple open source platforms.

socket-dev