🕵️ Contagious Interview

The items that name it 28

• The OpenSourceMalware Show #27
  talkas classification.key entities2026-10-29
• The OpenSourceMalware Show #26
  talkas classification.key entities2026-10-21
• The OpenSourceMalware Show #24
  talkas threat actors2026-10-09

  Fake job-interview attack playbook combining a GitHub repo and an npm package; this specific incident follows the playbook but is not yet attributed to DPRK or any named actor.

• PolinRider is A/B Testing its Way Past Your Detections
  writeupas threat actors2026-09-26

  Fake job interview lure that asks a developer to clone and run a project, hypothesized as the initial infection vector for the Binary-Mindz organization.

• The OpenSourceMalware Show #22
  talkas threat actors2026-09-25It is written here as Contagious Interview (aka WaterPlum).

  DPRK-linked campaign using fake job interviews to target web developers, engineers, and crypto/blockchain/Web3 specialists, posing as AI, crypto, and NFT companies. Subject of a joint FBI/international advisory (code name WaterPlum) reporting infection of 30,000 devices in more than 100 countries, e

• Trust and the enticing consultancy offer
  articleas classification.key entities2026-09-24
• WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials
  writeupas threat actors2026-09-17

  DPRK-associated tooling/campaign referenced as having meaningful code overlap with the recovered WeaselBiscuit code.

• The OpenSourceMalware Show #20
  talkas classification.key entities2026-09-09
• The OpenSourceMalware Show #19
  talkas classification.key entities2026-08-28
• The OpenSourceMalware Show #17
  talkas classification.key entities2026-08-14
• The OpenSourceMalware Show #16
  talkas threat actors2026-08-08

  DPRK campaign loosely linked to the NullReceiver technique based on overlapping tradecraft

• Before the first prompt: Code execution paths in trusted coding-agent projects
  writeupas classification.key entities2026-08-03
• NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding
  writeupas classification.key entities2026-08-02
• The OpenSourceMalware Show #15
  talkas threat actors2026-07-31

  DPRK social engineering campaign using fake job interviews to compromise developer machines, sometimes leading into PolinRider infection and persistence.

• OpenSourceMalware Blog
  articleas threat actors2026-07-18

  Campaign (with TaskJacker) hiding stage-2 loader inside git hooks that download InvisibleFerret and Beavertail malware.

• ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
  writeupas threat actors2026-07-17

  Campaign considered a parallel/related campaign to PolinRider per OpenSourceMalware's attribution.

• The OpenSourceMalware Show #13
  talkas threat actors2026-07-16

  Long-running North Korean campaign (several years) using fake recruiter/take-home coding test lures to compromise developers and steal crypto; now also delivering PolinRider payloads

• PolinRider Confirmed Footprint Grows 6.5x Since March
  writeupas threat actors2026-07-15

  DPRK campaign considered a parallel/related campaign to PolinRider; farms job-seeking developers via fake coding interviews/take-home tests.

• The OpenSourceMalware Show #12
  talkas threat actors2026-07-09

  Referenced as the North Korean campaign that PolinRider is described as a spin-off of, focused on developer targeting.

• PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
  writeupas classification.key entities2026-07-08
• Socket: PolinRider
  writeupas classification.key entities2026-07-02
• The OpenSourceMalware Show #10
  talkas threat actors2026-06-25
• OpenSource Malware: Active Malware Campaigns in January-May 2026
  writeupas classification.key entities2026-06-12
• Active Malware Campaigns in January-May 2026
  writeupas classification.key entities2026-06-08
• The Software Supply Chain Malware Landscape: January - May 2026
  articleas threat actors2026-06-03

  Campaign consistently publishing malicious packages to both npm and PyPI throughout the period, with PyPI packages appearing in the same weeks as the campaign's largest npm drops.

• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeupas threat actors2026-06-01

  North Korean fake job interview/developer-task lure campaign pattern; this incident is assessed as likely Contagious Interview-style lure

• Open Source Malware Podcast — episodes
  otheras threat actors2026-05-22

  Subject of new research discussed

• VSCode Lifecycle Script Malware
  writeupas threat actors2026-05-16

  Social engineering campaign sending fake job interview repositories containing malicious tasks.json