NICKEL ALLEY Contagious Interview Malware Campaigns

NICKEL ALLEY, a North Korean-affiliated threat group, continues to refine its 'Contagious Interview' campaign, primarily targeting software developers in the technology and financial sectors. Throughout late 2025, the group has evolved its tactics to include 'ClickFix' social engineering, where victims are tricked into running malicious local commands to 'fix' errors on fake job assessment websites. These commands initiate a complex infection chain leading to the deployment of PyLangGhost RAT, a Python-based evolution of their earlier GoLangGhost RAT.

The group heavily utilizes legitimate platforms like GitHub, LinkedIn, and Vercel to host malicious payloads and build credibility for fake corporate identities. Beyond PyLangGhost, they frequently deploy BeaverTail and OtterCookie malware designed to exfiltrate browser credentials, cookies, and specifically cryptocurrency wallet data. Security teams should be alerted to the group's strategic focus on gaining access to corporate environments, which suggests motivations beyond immediate financial theft, including potential long-term supply chain compromise or corporate espionage.