Lazarus Group Targets Developers with Contagious Interview Campaign

The 'Contagious Interview' campaign, attributed to the North Korean threat group LAZARUS (also tracked by OpenSourceMalware team as Fake Font), specifically targets software developers through fraudulent recruitment processes on platforms like LinkedIn and GitHub. Adversaries establish trust before inducing victims to clone malicious repositories or install hijacked npm/Go packages. These artifacts contain cross-platform malware designed to siphon credentials, SSH keys, and cryptocurrency wallets from developer workstations.

Technically, the campaign has evolved to abuse Visual Studio Code (VS Code) task automation to trigger execution automatically upon opening a project folder. The malware chain utilizes a multi-stage approach, starting with Node.js or Python-based loaders that retrieve next-stage payloads from blockchain transaction data (TronGrid/Aptos) or JSON storage services. The final objective is the deployment of the InvisibleFerret Python backdoor and associated stealers (GolangGhost, PyLangGhost), which provide both persistent interactive remote access and broad automated data harvesting.

This campaign represents a significant shift in intrusion tradecraft, where the adversary externalizes the execution step to the victim within a trusted developer workflow. By compromising developer environments, LAZARUS gains high-privileged access to source code repositories, CI/CD pipelines, and cloud infrastructure, creating severe downstream supply chain risks.