Contagious Interview is a North Korean state-sponsored operation attributed to Famous Chollima, a subgroup of the Lazarus APT cluster. Microsoft's research confirms the campaign has been active since at least December 2022, and it's still compromising developer machines in 2026.

The concept is straightforward but effective. Threat actors pose as legitimate recruiters on LinkedIn, job boards, and freelance platforms. They conduct multi-stage interview processes that mirror real technical hiring - recruiter outreach, phone screens, technical discussions, and take-home coding assignments. The coding assignment is where the malware lives.

This isn't a mass spam operation. SentinelOne's research found over 230 confirmed victims between January and March 2025 alone, with the actual number likely much higher. The attackers have created entire front companies - BlockNovas LLC, Angeloper Agency, and SoftGlideLLC - complete with AI-generated employee photos built using tools like Remaker AI. The FBI seized the BlockNovas domain in April 2025, but the broader campaign continues under new infrastructure.

What makes this particularly dangerous for Katy and Houston area businesses: the attack doesn't target your perimeter or your firewall. It targets the trust your developers place in normal professional interactions.

Attack Chain Overview

The Contagious Interview attack chain is built on social engineering, not technical exploits. That's what makes it so difficult to block with traditional security tools. Here's how a typical attack unfolds:

Initial Contact

A recruiter reaches out through LinkedIn, Indeed, or a similar platform. The profile looks legitimate. The company has a website, employees, and open positions. In some cases, attackers even use legitimate video interview platforms like Willo for the initial screening rounds.

The Technical Assessment

After one or two conversations that feel entirely normal, the developer receives a coding assignment. This arrives as a GitHub repository, an npm package, or a Visual Studio Code project. The code looks like a real assessment - it has README files, configuration, and functional code alongside the hidden payload.

Malware Execution

When the developer runs npm install, opens the VS Code project, or executes the assessment code, the malware activates. Some variants use a ClickFix technique - displaying a fake camera error during a video call and prompting the candidate to "download a driver update" that is actually the malware payload. Others embed the malicious code in postinstall hooks that run automatically during package installation.

Persistence and Exfiltration

Once running, the malware establishes encrypted command-and-control channels, installs persistent backdoors, and begins harvesting credentials, crypto wallets, and sensitive files from the developer's machine. Some variants also install AnyDesk for direct remote access.

The Contagious Interview campaign doesn't rely on a single piece of malware. It deploys a modular toolkit where each component handles a different phase of the attack. Microsoft and multiple security vendors have documented four primary malware families:

BeaverTail

The initial stage malware, typically delivered through malicious npm packages or trojanized code repositories. BeaverTail functions as both an information stealer and a downloader. It targets 13 or more cryptocurrency wallet browser extensions, steals browser credentials and credit card data, then downloads and installs the next-stage backdoor. Variants exist for Windows, macOS, and Linux - compiled from shared source code using Qt or delivered as JavaScript payloads.

InvisibleFerret

A Python-based backdoor deployed by BeaverTail. InvisibleFerret enables remote command execution, extended system reconnaissance, and persistent control. It includes separate modules for downloading additional payloads, stealing browser credentials, and maintaining a command-and-control connection. Microsoft has observed continuous code updates between attack waves, showing active development.

OtterCookie

A JavaScript-based backdoor first spotted in September 2024. The latest variant tracked since October 2025 introduces heavy obfuscation that hides strings, URLs, and logic through encoded index lookups and shuffled arrays. OtterCookie includes clipboard monitoring, recursive file scanning, curl-based data exfiltration, and VM-awareness to detect sandbox environments. Recent versions have started merging functionality from both BeaverTail and InvisibleFerret into a single JavaScript payload.

FlexibleFerret

A modular backdoor implemented in both Go and Python variants. FlexibleFerret uses encrypted HTTP(S) and TCP channels to load plugins dynamically, execute remote commands, and handle file upload and download operations. It persists through Windows registry modifications and includes built-in capabilities for reconnaissance and lateral movement. Microsoft noted that some samples contain tutorial-style comments and emoji-based logging, suggesting the use of AI development tools in the malware's creation.

The initial targets were cryptocurrency and Web3 developers - a natural fit for a campaign aimed at stealing digital assets. But Microsoft's 2026 analysis confirms the target list has broadened significantly:

• Software developers at enterprise solution providers - companies building products for other businesses
• Media and communications firms - likely targeted for infrastructure access and credential harvesting
• Cryptocurrency and blockchain developers - the original and still primary target vertical
• Freelance developers on platforms like Upwork and Freelancer - where fake personas can operate with less scrutiny

The campaign has also started experimenting with targeting non-developer roles. GitLab Security Research documented variants targeting marketing and trading positions in cryptocurrency and retail organizations using compiled executables instead of script-based payloads - recognizing that non-developers are less likely to have Python or Node.js installed.

For Houston-area businesses in engineering, energy services, and technology sectors, the risk is real. If your company employs developers, contracts with development agencies, or uses custom-built software, those developers are potential targets whether they're based in Katy, Sugar Land, or working remotely from anywhere.

Microsoft's analysis and corroborating research from Unit 42, Cisco Talos, and SentinelOne paint a clear picture of what the Contagious Interview malware suite targets once it's running on a system:

• Browser credentials and saved passwords from all major browsers
• Cryptocurrency wallet data from 13+ wallet browser extensions including MetaMask and Bitcoin wallets
• API tokens and cloud service credentials - AWS, Azure, GCP access keys
• Code signing keys used to verify the authenticity of software builds
• Password manager artifacts including vault data
• System fingerprint data - hostname, network identifiers, OS details, public IP
• Clipboard contents monitored continuously for sensitive data
• Files matching specific patterns - anything named "backup," "phrase," "seed," or related to cryptocurrency recovery

The malware also establishes persistent remote access, meaning attackers can return to the compromised machine at any time. Some variants install AnyDesk for direct remote desktop control. Others maintain encrypted command-and-control channels that support file upload, download, and arbitrary code execution.

In 30 years of working in IT, the pattern I see with attacks like this is that the immediate credential theft is just the beginning. The real damage comes from what attackers do with sustained access to a developer's machine over days or weeks - moving laterally into build systems, source repositories, and production environments.

Microsoft's recommendations, combined with guidance from the broader security research community, focus on treating recruitment workflows as a genuine attack surface. Here are the steps that matter most for Houston-area small and mid-sized businesses:

Isolate Interview and Assessment Environments

Require developers to use dedicated, non-persistent virtual machines for any coding tests, take-home assignments, or repository reviews from interview processes. The VM should have no access to corporate credentials, internal repositories, or cloud services. Destroy it after each use.

Harden Developer Endpoints

Enable tamper protection and real-time antivirus on all developer machines. Restrict execution of Node.js, Python, and PowerShell from Downloads and temporary folders where possible. Consider application control policies that limit which binaries can run and from where.

Train Developers to Spot Red Flags

The warning signs are specific: short links redirecting to file hosting services, newly created GitHub repositories or accounts, unusually complex assessment setup instructions, and requests to disable security controls or trust unknown repository authors. Any instruction asking a developer to run curl piped to sh during an interview process should be treated as hostile.

Monitor for Suspicious Activity

Watch for unusual npm package installations, unexpected Node.js or Python processes, clipboard monitoring tools, and outbound connections to uncommon domains. Microsoft published specific detection queries for Defender XDR customers - your managed IT provider should be implementing equivalent monitoring.

Verify Recruiters and Companies

Before engaging with any recruiter, verify the company independently. Check domain registration dates - many front companies used in these campaigns were registered recently. Look for AI-generated profile photos. Cross-reference the company against known business registrations. If anything feels off about the interview process, trust that instinct.

Attacks like Contagious Interview don't trigger your firewall. They don't exploit a known vulnerability with a patch available. They exploit human trust in professional workflows - and that requires a different kind of defense. CinchOps helps Houston-area businesses build that defense through layered protection that addresses both technical controls and human factors.

• Endpoint detection and response (EDR) configured specifically for developer workstations, monitoring for suspicious script execution, clipboard access, and unexpected outbound connections
• Security awareness training tailored to technical staff, covering recruitment-based social engineering and supply chain attack patterns - not just generic phishing simulations
• Application control policies that restrict code execution from untrusted locations without breaking legitimate development workflows
• Network monitoring and threat detection to identify command-and-control beaconing, unusual data exfiltration patterns, and lateral movement attempts
• Incident response planning specific to developer endpoint compromise, including credential rotation procedures, repository audit workflows, and build system integrity verification
• Virtual machine and sandbox configuration for secure evaluation of third-party code, interview assignments, and open-source dependencies

We see at least a couple of these social engineering attempts targeting Houston businesses every month. The organizations that handle them well are the ones that planned for them before they happened. Contact CinchOps to evaluate your exposure and build a protection plan that addresses threats like Contagious Interview head-on.