- A North Korean group behind the Contagious Interview campaign now uses JSON storage services to host Malware payloads.
- The attackers lure targets on professional networks to download trojanized code from legitimate repositories.
- Malware includes JavaScript BeaverTail and a Python backdoor called InvisibleFerret with updated payload delivery.
- The campaign also employs additional tools like TsunamiKit for system fingerprinting and data theft.
- Legitimate platforms help the attackers evade detection by blending malicious traffic with normal activity.
Threat actors from North Korea linked to the Contagious Interview campaign have adopted new tactics in late 2025 by using JSON storage services such as JSON Keeper, JSONsilo, and npoint.io to distribute malware payloads. These changes were detailed by researchers Bart Parys, Stef Collart, and Efstratios Lontzetidis, who noted the group’s use of trojanized code projects as a baiting method detailed here.
The attackers approach potential victims on professional networking platforms like LinkedIn, posing as collaborators or recruiters conducting job assessments. Targets are then prompted to download demo projects hosted on popular code-sharing sites such as GitHub, GitLab, or Bitbucket. Within these projects, a file named “server/config/.config.env” often contains a disguised Base64-encoded URL linking to JSON storage services where the following-stage malware is hidden in an obfuscated format.
The primary malware identified is a JavaScript strain called BeaverTail, which steals sensitive information. BeaverTail also deploys a Python backdoor named InvisibleFerret. This backdoor remains mostly unchanged from its initial report by Palo Alto Networks in late 2023, except for its new ability to retrieve an additional payload, TsunamiKit, from Pastebin.
Earlier reports from ESET in September 2025 confirmed Contagious Interview’s use of TsunamiKit alongside other tools like Tropidoor and AkdoorTea. TsunamiKit serves functions such as system fingerprinting, data collection, and downloading further payloads from a hardcoded .onion address, which is currently inactive.
Researchers concluded, “It’s clear that the actors behind Contagious Interview are not lagging behind and are trying to cast a very wide net to compromise any (software) developer that might seem interesting to them, resulting in exfiltration of sensitive data and crypto wallet information.” They also highlighted how the usage of legitimate JSON storage platforms and popular code repositories supports the attackers’ goal of remaining stealthy and blending malicious operations with normal network traffic.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- XRP Set to Skyrocket to $4 with Multiple ETFs on Horizon
- Cypherpunk Shares Soar 97% as Zcash Defies Crypto Market Drop
- Hedera Adds ERC-3643 Standard to Boost Global Asset Tokenization
- BlackRock’s Tokenized Treasury Fund Now Collateral on Binance
- Critical Code Execution Flaws Hit Major AI Engines via ShadowMQ Vulnerability
