Executive Summary
The DPRK-linked Contagious Interview campaign has evolved to incorporate ErrTraffic, a ClickFix kit-as-a-service, to scale its infection operations. Historically reliant on targeted social engineering via LinkedIn and fake technical interviews, the threat actor is now buying untargeted traffic from thousands of compromised WordPress sites. These sites present fake 'Human Verification' overlays that trick users into executing malicious commands via the Windows Terminal (Win+X, I).
The technical workflow involves a multi-stage Node.js infection chain. It utilizes Polygon smart contracts as decentralized C2 resolvers to bypass traditional domain blacklisting. The final payloads include the BeaverTail RAT and specialized 'Keyboard Sync Agent' and 'Chrome Key Stealer' components designed to exfiltrate seed phrases, browser-saved credentials, and session cookies.
This shift highlights an convergence of targeted APT tradecraft with commodity 'trafficker' services. Financial services, cryptocurrency organizations, and individual developers remain the primary targets, with a high risk of immediate asset loss following successful compromise.
Key Details
Threat Name
Contagious Interview
Affects
—
Adversary
UNC5342 Other Adversaries and Aliases: Lazarus
MITRE Techniques
Malware/Tools
ErrTraffic, BeaverTail, JADESNOW, INVISIBLEFERRET, TURNTIP, NOCHAIN, CLEARFAKE