North Korean threat actors use JSON sites to deliver malware via trojanized code

Securityaffairs.Co •Pierluigi Paganini • November 17, 2025

North Korean Contagious Interview actors now host malware on JSON storage sites to deliver trojanized code projects, NVISO reports. North Korea-linked actors behind the Contagious Interview campaign have updated their tactics, using JSON storage services (e.g. JSON Keeper, JSONsilo, and npoint.io) to host and deliver malware through trojanized code projects, according to a new NVISO report. “NVISO […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Actors Use JSON Services for Malware Delivery North Korean threat actors have adopted new tactics by utilizing JSON storage services to host and deliver malware through trojanized code projects. This method is part of the Contagious Interview campaign, as reported by NVISO. The use of services like JSON Keeper and JSONsilo marks a significant evolution in their malware distribution strategies. 3 sources 38

Extracted Entities

North Korean threat actors use JSON sites to deliver malware via trojanized code

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Countries (1)

Platforms (3)