North Korea’s Contagious Interview operators have switched things up again, and it’s honestly the kind of change that makes sense once you see it. Instead of the usual compromised websites or odd URLs, they’re now using plain JSON storage sites, the type developers barely think twice about. NVISO spotted the shift and broke down how the attackers are dropping payloads into places like JSON Keeper, JSONsilo, and npoint.io. Nothing fancy. Just quiet, convenient, and very effective if your target is a software developer who pulls random resources all day.
The playbook hasn’t changed much: they reach out on LinkedIn pretending to be a recruiter or someone wanting help with a project. The classic “can you check this demo?” trick. And of course, the “demo” sits on GitHub, Bitbucket, GitLab, anywhere developers already trust.
One project NVISO dug through had a file buried inside it — server/config/.config.env. Looks innocent. Inside was a Base64 blob pretending to be an API key. When decoded, it didn’t look like an API key at all but rather a link to a JSON hosting service. That’s where the real payload lived, obfuscated and waiting.
The malware chain hasn’t changed dramatically. The first piece is BeaverTail, a JavaScript info-stealer. Once it runs, it drops InvisibleFerret, a Python backdoor researchers have seen before. Palo Alto Networks wrote about it back in late 2023, and honestly, most of its behavior still lines up. What’s different is that the new infections are pulling down a tool called TsunamiKit from Pastebin. ESET mentioned this piece a few months ago, around September 2025, tied to other implants like Tropidoor and AkdoorTea. The whole toolkit can fingerprint systems, grab data, and reach out to a .onion endpoint (which, interestingly, is offline right now but still hard-coded).
NVISO’s takeaway was pretty blunt: the group is casting a wide net. They’re not targeting one company or one sector, they’re going after pretty much anyone writing code who looks interesting. That means personal data, internal documents, and even crypto wallet info can end up exfiltrated without the victim realizing anything happened.
What stands out most is their reliance on completely benign platforms, JSON Keeper, JSONsilo, npoint.io, GitHub, GitLab, basically the exact places security tools rarely flag because the traffic looks normal. And that’s the whole point. They want to disappear into the background noise of a developer’s everyday workflow. And right now, they’re doing it well.
Source: The Hacker News
