Lazarus Contagious Interview Credential & Token Harvesting from Dev Workstation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects unauthorized file access to common developer credential storage locations on Linux workstations, including SSH keys, cloud provider configuration files, and browser session artifacts. This behavior is associated with the InvisibleFerret payload used in the Lazarus Contagious Interview campaign to exfiltrate identity and access tokens from developer machines.