Contagious Interview Operators Move Beyond Git Hooks With Trojanized Mac Applications

Gbhackers •Mayura Kathir • September 4, 2026

North Korea-linked Contagious Interview operators have expanded their developer-targeting malware delivery operation beyond booby-trapped Git hooks and coding repositories, using trojanized macOS applications distributed as disk images and installer packages. Jamf Threat Labs identified 14 malicious DMG and PKG samples impersonating legitimate Mac software, all of which ultimately deliver an OtterCookie-aligned JavaScript implant designed for […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Operators Target Developers with OtterCookie Malware on macOS A malware campaign identified by Jamf Threat Labs targets macOS developers using trojanized disk images and installer packages to deliver OtterCookie malware. The attackers, linked to North Korea, utilize fake job interview lures to trick victims into executing malicious code. The campaign involves a multi-stage execution chain that modifies Info.plist files in application bundles and PKG installers. Analysts found 14 malicious DMG and PKG samples impersonating legitimate software, ultimately delivering a JavaScript implant. Users are advised to avoid running unsigned applications and to isolate affected endpoints immediately. A forensic investigation is recommended to trace the initial delivery vector, which may include compromised Git repositories. The malware employs tools like Go-compiled shell scripts and the Bunster tool for deployment. Organizations can use Jamf for advanced threat controls to mitigate risks. 2 sources 74

Extracted Entities

Contagious Interview Operators Move Beyond Git Hooks With Trojanized Mac Applications

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Countries (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)