The backdoor begins executing without any visible action on their part.
In the quiet ritual of opening a code project, a developer unknowingly becomes the target of a state-sponsored operation. North Korean hackers, operating under the campaign known as Contagious Interview, have turned the familiar tools of software development — job interviews, GitHub repositories, Visual Studio Code — into instruments of infiltration, pursuing the financial lifelines that cryptocurrency and fintech developers unknowingly carry. The attack asks nothing unusual of its victims; it simply waits for them to do what they always do, and then it begins.
- Developers in crypto and fintech are being approached on LinkedIn with convincing job offers that serve as the opening move in a state-sponsored cyberattack.
- Opening a cloned repository in VS Code silently triggers malicious task files, launching a backdoor before the developer has read a single line of code.
- The malware operates in layered stages — harvesting keystrokes, capturing screenshots, intercepting clipboard data, and mining cryptocurrency — all while disguising itself as routine development activity.
- Attackers are iterating rapidly, swapping payloads, multiplying delivery methods, and using AI-assisted obfuscation to stay ahead of detection tools.
- Defenders are urging developers to treat every unsolicited repository as a potential threat — reviewing task files, verifying sources, and auditing npm packages before a single line executes.
A developer receives a LinkedIn message from someone claiming to represent a startup called Meta2140. There is a job opportunity, a technical assessment, a GitHub link. They clone the repository, open it in Visual Studio Code, and within seconds — without clicking anything — a backdoor begins running on their machine.
This is the architecture of Contagious Interview, a North Korean hacking campaign that has been evolving since at least December 2025. Its power lies not in technical brute force but in the exploitation of trust — trust in familiar tools, familiar platforms, and familiar hiring rituals. VS Code's task configuration feature, designed to automate build steps, becomes the attack's entry point. Malicious commands hide inside these files, executing the moment a project folder opens, before any inspection is possible. If the primary payload server is unreachable, obfuscated JavaScript — sometimes disguised as a spell-check dictionary — ensures the attack continues regardless.
On macOS, the infection chain is especially persistent. A background shell command pipes remotely fetched JavaScript directly into Node.js, keeping the malware alive even after VS Code is closed. Every five seconds, the compromised system phones home. Within minutes, a second-stage payload arrives — one whose structure suggests AI-assisted generation — capable of logging keystrokes, capturing screenshots, intercepting cryptocurrency wallet addresses, and extracting browser credentials.
The malware deploys two parallel infection layers: BeaverTail, handling reconnaissance and credential theft through Node.js, and InvisibleFerret, enabling crypto mining and data exfiltration through Python. Some variants also deliver Tsunami, a backdoor bundled with XMRig, a miner that quietly consumes the victim's computing resources.
The targeting is deliberate. Developers in cryptocurrency, blockchain, and fintech carry privileged access to digital wallets, source repositories, and financial infrastructure. For a sanctioned regime with constrained economic options, a single compromised engineer can unlock millions. The fake interviews succeed because they are indistinguishable from real ones — hosted on legitimate platforms, structured like genuine assessments, asking nothing suspicious.
The defense is available but demands discipline: review task files before opening any unfamiliar repository, verify sources, audit npm packages, and treat unsolicited technical assessments with the skepticism they deserve. The attackers are not slowing down, and the tools they are turning against developers are the same ones developers rely on every day.
A developer receives a message on LinkedIn. Someone claiming to be a tech executive at a startup called Meta2140 wants to discuss a job opportunity. There's a technical assessment attached—nothing unusual for the industry. The assessment includes a link to a code repository. The developer clones it. They open the project in Visual Studio Code, the editor most of them use every day. Within seconds, without any visible action on their part, a backdoor begins executing on their machine.
This is how North Korean hackers are now hunting software engineers. The campaign, which security researchers call Contagious Interview, has been evolving since at least December 2025, and its latest iteration is particularly insidious because it weaponizes the trust developers place in their own tools.
The attack works by exploiting a feature in VS Code that most developers never think about: task configuration files. When you open a project in VS Code, the application can be set to automatically run predefined tasks. The hackers hide malicious commands inside these task files, disguised as legitimate build steps or development utilities. They configure the tasks to execute the moment a project folder opens—before the developer has any chance to inspect what's actually running. The malicious code then reaches out to servers hosted on Vercel, a legitimate cloud platform, to download additional payloads. If that connection fails, the attackers have built in fallback mechanisms: obfuscated JavaScript embedded directly in the task files, sometimes disguised as spell-check dictionaries, ensures the attack proceeds regardless.
Researchers at Jamf Threat Labs discovered that on macOS systems, the attack chain uses a particularly clever technique. A background shell command retrieves JavaScript code from a remote server and pipes it directly into Node.js, allowing the malware to continue running even if the developer closes VS Code. The initial payload establishes a persistent loop, harvesting information about the infected system and communicating with attacker-controlled servers every five seconds. Within minutes, additional JavaScript instructions arrive—code that appears to have been generated by an artificial intelligence tool, based on its structure and inline comments. This second-stage payload can log keystrokes, capture screenshots, scan the home directory for sensitive files, intercept cryptocurrency wallet addresses copied to the clipboard, extract credentials from web browsers, and install remote access tools like AnyDesk.
The sophistication doesn't stop there. The malware deploys two distinct layers of infection. One, called BeaverTail, runs in Node.js and handles reconnaissance and credential theft. The other, InvisibleFerret, operates in a parallel Python environment and enables cryptocurrency mining, keylogging, and data exfiltration. Researchers have also observed variants that deliver a backdoor called Tsunami, which comes bundled with XMRig, a cryptocurrency miner that silently consumes the victim's computing resources.
Why target developers? The answer is financial and strategic. North Korean threat actors specifically pursue software engineers working in cryptocurrency, blockchain, and fintech sectors. These individuals often have privileged access to digital wallets, source code repositories, and the technical infrastructure that controls financial assets. Compromising a single developer can unlock access to millions of dollars in cryptocurrency, proprietary code, and internal systems. For a heavily sanctioned regime with limited legitimate economic options, this represents a direct pipeline to resources.
What makes this campaign particularly effective is how it exploits the social engineering layer. The fake job interviews feel real because they mimic actual hiring practices. The repositories look legitimate because they are hosted on real platforms like GitHub, GitLab, and Bitbucket. The task files look like normal development configuration because they are. The attacker isn't asking the developer to do anything suspicious—just participate in a job assessment, a routine part of the hiring process in tech. By the time the developer realizes something is wrong, the backdoor is already installed.
Security researchers have observed the attackers rapidly iterating on their techniques. The payloads change frequently. The delivery methods multiply—some variants use malicious npm packages, others rely on task files, still others combine multiple approaches to increase the odds that at least one will succeed. This speed of adaptation suggests the attackers are learning from each attempt, refining their tools based on what works and what gets detected.
For developers, the defense is straightforward but requires vigilance. Before opening any repository in VS Code, especially one shared during a job interview or by someone you don't know, review the code first. Check the task configuration files. Verify the source of the repository. Install only npm packages from trusted maintainers. Be skeptical of unsolicited job offers, particularly those that come with immediate technical assessments. The threat is real, the stakes are high, and the attackers are not slowing down.
Citas Notables
When the project is opened, Visual Studio Code prompts the user to trust the repository author. If that trust is granted, the application automatically processes the repository's tasks.json configuration file, which can result in embedded arbitrary commands being executed on the system.— Thijs Xhaflaire, security researcher at Jamf Threat Labs
While monitoring, we've seen the malware that is being delivered change very quickly over a short amount of time. This particular threat actor has a reputation for adapting quickly.— Jaron Bradley, director of Jamf Threat Labs
La Conversación del Hearth Otra perspectiva de la historia
Why would North Korean hackers focus specifically on developers in crypto and fintech? There are easier targets.
Because these developers have something most people don't: direct access to money. A compromised accountant might see numbers. A compromised engineer at a crypto exchange has keys to wallets containing millions. The attackers aren't interested in espionage for its own sake—they're interested in theft and funding a regime that can't earn money legitimately.
The fake job interview angle is clever. How do they make it convincing?
They do their homework. They find real people on LinkedIn, research the companies they work for, understand what a legitimate technical assessment looks like. Then they create a plausible scenario—a startup hiring, a technical test, a code repository to evaluate. It's not magic. It's just patience and attention to detail.
Once the malware is installed, what's actually happening on the developer's machine?
Everything. The attackers can see what you type, what you copy, what files you have. They can steal your cryptocurrency wallet credentials. They can access your source code. They can use your computer to mine cryptocurrency for them. And they do it all in the background while you're working, completely unaware.
Why use VS Code tasks specifically? Why not just ask people to run a script?
Because VS Code tasks are trusted. They're part of the normal development workflow. When VS Code prompts you to trust a repository, most developers click yes without thinking. It's like asking someone to open an email attachment from their boss—the context makes it feel safe.
The malware uses AI-generated code. Does that mean the attackers are using AI to write their malware?
Possibly. Or they're using AI to obfuscate it, to make it harder for security tools to detect. Either way, it shows they're not static. They're experimenting with new tools, new techniques, new ways to stay ahead of defenders.
What's the one thing a developer should do right now?
Before you open any repository in VS Code, especially one from someone you don't know, look at the task files first. Open them in a text editor. Read them. If you see commands that fetch code from the internet or execute JavaScript, stop. That's not normal. That's a red flag.