Contagious Interview Malware Suite Artifacts (BeaverTail/InvisibleFerret/OtterCo

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•6

This rule detects artifacts and behaviors associated with the WaterPlum/Contagious Interview (also known as DeceptiveDevelopment) malware suite, including BeaverTail, InvisibleFerret, and related payloads. The rule specifically targets the presence of embedded family-name strings, as well as the execution of suspicious npm package installations triggered by VS Code task automation (tasks.json) or trust prompts, common in fake technical interview attack scenarios.