Contagious Interview campaign exploits JSON storage for malware deployment

GBHackers News reports that North Korean state- threat actors have been leveraging JSON storage services to distribute malware as part of the Contagious Interview campaign , which has been underway since 2023.

Attacks involved the impersonation of medical directors and other hiring professionals on to spread a "demo project" from GitLab and other repositories, which lured targets into executing interview coding tasks via Node.js, findings from an NVISO Labs analysis revealed.

Numerous API key-spoofing base64-encoded variables within the demo project's configuration files, which refer to JSON Keeper, JSON Silo, and other legitimate JSON storage services, facilitate the eventual deployment of the BeaverTail information-stealing malware that then spreads the InvisibleFerret RAT payload.

InvisibleFerret features a multi-component framework, including the Tsunami payload for scheduled task creation, Tsunami Injector for persistence, and Tsunami Infector for covert Python installation. Such a threat should prompt more stringent review processes for recruitment activities and intensified monitoring of suspicious API requests to JSON storage services.