DPRK Abuse of VS Code Tasks in “Contagious Interview” Operations

Du'aine Davis

Observed in the wild

• The North Korean–aligned persistent “Contagious Interview” campaign continues targeting software developers and security researchers through fraudulent LinkedIn recruiter approaches. Targets received malicious “take‑home assessments” or code‑review requests hosted in Bitbucket repositories. Multiple victims in the past month reported substantial financial losses after enabling VS Code “Trusted Workspace,” which triggered hidden malware despite them not executing code directly.
• Attackers used social‑engineering lures from fabricated high‑follower recruiter profiles, delivering a malicious repository embedding VS Code Tasks execution hooks and npm scripts. The malware employed a dual‑stack architecture: an initial Node.js layer (credential theft, keylogging, covert RAT in .npm) and a Python layer (surveillance, crypto‑wallet theft, mining).
• Developers are advised to minimise VS Code’s attack surface: avoid enabling “Trusted Workspace” for unverified repositories, verify VS Code tasks and npm scripts, and check for filesystem artefacts linked to BeaverTail/InvisibleFerret. The malware exhibits identifiable behaviour and limited cross‑platform persistence, allowing Microsoft Defender and similar tools to detect suspicious Node.js/Python activity, .npm directory‑based RAT persistence, and unexpected automated task execution in VS Code

VS Code Tasks Abuse by Contagious Interview (DPRK)