Contagious Interview Pivots to Dev-Review Lures in Two Fresh Campaigns
The North Korea-linked cluster is back with phishing pretexts aimed at developers — recruiter pitches and code-review requests that drop malware on engineers' workstations.
Two recent phishing campaigns share enough tradecraft with a long-running North Korean operation that researchers are tagging them as the same crew.
The cluster goes by several names: Contagious Interview, Famous Chollima, HexagonalRodent, and Void Dokkaebi. Threat intel published this week attributes both campaigns to that group, and the lures are aimed squarely at software developers.
The pretexts are familiar. One impersonates recruiters dangling developer roles. The other asks targets to review code — a request engineers receive constantly and rarely treat as hostile.
That is the point.
Contagious Interview has run variations of this play for more than two years. Previous iterations pushed candidates through fake interview pipelines that ended with a request to clone a repository, run a take-home assignment, or install a video-conferencing client. The payloads have rotated through BeaverTail, InvisibleFerret, and OtterCookie families, often staged via npm packages or GitHub repos crafted to look legitimate.
The operation's strategic interest is consistent. Initial access to developer machines means access to source code, signing keys, cloud credentials, and — in the cases that have made headlines — cryptocurrency wallets. The FBI and Treasury's OFAC have repeatedly tied DPRK IT-worker and developer-targeting schemes to sanctions evasion and weapons-program funding.
What is new here is the code-review framing. Recruiter lures have been burned in dev circles for a while; engineers warn each other on forums and in Slack groups. A polite request to look over a pull request or audit a snippet lands differently. It flatters the target's expertise and sidesteps the usual "is this recruiter real?" filter.
Proofpoint's writeup is the primary source for the new activity attribution.
Jurisdiction on any victim notifications will depend on where targeted developers sit. US victims fall under FBI IC3 reporting and, for employers, state breach-notification statutes if PII or credentials are exfiltrated. EU-based engineers trigger GDPR Article 33 obligations on their employers. Australian targets fall under the OAIC's Notifiable Data Breaches scheme.
What developers and security teams should do:
- Treat unsolicited code-review requests the same as unsolicited recruiter contact. Verify the requester through a second channel before cloning anything.
- Run interview tasks, take-homes, and untrusted repos inside a disposable VM or container with no access to credential stores, SSH keys, or cloud CLI sessions.
- Audit npm, PyPI, and GitHub activity on developer endpoints for installs from accounts created in the last 90 days.
- Rotate any tokens, SSH keys, or cloud credentials present on a machine that touched a suspicious repo, and check for outbound traffic to known BeaverTail and InvisibleFerret indicators.
Recruiter spam will keep working until it doesn't. Code-review bait is the next iteration. Engineers should expect more of it.
