Contagious Interview — BeaverTail / OtterCookie Developer-Workstation Hunt

Contagious Interview is a North Korean (DPRK) threat cluster — tracked as Famous Chollima / Void Dokkaebi / HexagonalRodent under the Lazarus umbrella — that has industrialized its 2022-era fake-interview social engineering into a high-volume supply-chain operation. In its June 2026 evolution the actor sends recruitment-themed phishing emails (250+ emails in a six-week window to individuals at nearly 100 organizations in finance, crypto, education and tech) that link to actor-controlled GitHub repositories (e.g. the stardev0914 account). Victims — often mid-assessment job candidates — clone the repo, open it in VS Code or Cursor, and approve the editor's "trust the authors" prompt. That trust authorizes automatic execution of the project's tasks.json / postinstall hooks, which run OS-specific loaders (shell script on macOS/Linux, VBScript on Windows) that fetch the next stage from Vercel-hosted infrastructure.

The delivered payloads are the BeaverTail first-stage stealer/loader and the OtterCookie beaconing agent (both increasingly launched by GenAI-assisted loaders such as XORIndex/HexEval), pulling in the InvisibleFerret backdoor as a later stage. The objective is theft: browser-extension and desktop cryptocurrency wallets, browser credential stores, and clipboard contents. The campaign has seeded 1,700+ malicious packages across npm, PyPI, Go, Rust and Packagist, exfiltrated 26,584 crypto wallets from 2,726 infected developer systems, and stolen roughly $12M in cryptocurrency in the first three months of 2026.

The decisive defensive angle is developer-workstation behavior, not atomic IOCs (packages and repos rotate hourly). The unmistakable signal is a code editor (Code.exe / cursor / node / npm) spawning a network-download utility (curl, powershell, wscript, bash -c curl) immediately after a repo is opened, followed by access to browser wallet-extension directories and an outbound connection to hardcoded IP-based HTTP infrastructure.

Defender priority: Hunt for npm / node / VS Code (Code.exe) / Cursor processes spawning curl, powershell -enc, wscript, or osascript on developer endpoints, then pivot any hit to browser-wallet-directory reads and outbound connections to raw IPv4 HTTP endpoints (e.g. 23.137.105[.]75:5173). Treat editor-triggered network downloads on a workstation as guilty until proven benign.

Hunter note: Atomic package names and GitHub repos rotate continuously (1,700+ packages, 18+ npm accounts). Detection weight is placed on the behavioral chain; named packages are included as point-in-time blocklist/hunt seeds with appropriate expiry, every one traced to a cited source.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): A code editor or package manager (Code.exe, cursor, node, npm, yarn, pnpm) spawns a network-download interpreter (curl, wget, powershell -enc, wscript, cscript, osascript) shortly after a repo is opened. (T1059, T1204.002)
2. H2 (high): npm/node executes a lifecycle/postinstall hook that immediately reaches an external host or raw IPv4 endpoint. (T1195.002, T1071.001)
3. H3 (high): A developer-tool process tree connects outbound to a hardcoded IP-literal HTTP endpoint on a non-standard port (e.g. :5173) — BeaverTail/InvisibleFerret exfil. (T1071.001, T1041)
4. H4 (medium): A non-browser process reads browser wallet-extension or Login Data directories (MetaMask/Phantom IDs, Local Extension Settings, Login Data). (T1555.003, T1539, BeaverTail wallet theft)
5. H5 (medium): Windows persistence via Run-key or Scheduled Task pointing at node/python/wscript in a user profile/Temp path; macOS/Linux persistence via git hooks. (T1547.001, T1053.005)
6. H6 (medium): python loads or writes Cython-compiled .pyd/.so modules (InvisibleFerret migration) or executes from a cloned-repo path. (T1059.006, T1027)
7. H7 (low): Outbound to Vercel/GitHub raw content fetching an executable payload from within a developer process tree. (T1105)

Attack chain

Provenance: every atomic IOC below traces to a cited Tier-1 source (see §18). Package indicators are point-in-time and high-churn — use as hunt/pivot seeds, not standing blocks, and expire on schedule.

• Mail gateway / proxy: Hunt inbound mail with body links to github.com/<new-account> clone URLs paired with recruiter/assessment language ("coding assessment", "take-home", "interview task"). Flag first-seen GitHub orgs.
• npm/registry telemetry: If you run an internal registry or Artifactory/Verdaccio, alert on installs of the §4 package names and on first-seen packages with postinstall scripts that perform network I/O.
• VS Code / Cursor config: On managed dev fleets, audit for repos containing .vscode/tasks.json with "runOptions": {"runOn": "folderOpen"} and for .githooks/pre-commit shipped inside cloned repos.
• macOS Unified Log / Linux auditd: Hunt osascript/curl/bash -c children of node, Code Helper, or cursor; and git core.hooksPath changes.
• Endpoint DNS: Review resolutions to freshly-registered *.vercel.app subdomains from developer hosts immediately preceding executable writes.

// HUNT: Editor/pkg-mgr spawns download interpreter (Contagious Interview repo-open)
// MITRE: T1204.002, T1059  | CONF: high  FP: med  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: build tooling, legitimate npm postinstall, CI agents
// TUNING: exclude known build/CI hosts; corroborate with Q3 raw-IP C2
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(Code\.exe|Code - Insiders\.exe|cursor\.exe|cursor|Code Helper.*|node|node\.exe|npm|npm\.cmd|yarn|pnpm)$/i
| FileName=/^(curl|wget|powershell|pwsh|wscript|cscript|mshta|bitsadmin|certutil|bash|sh|osascript|python3?)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine], limit=200)

// HUNT: npm/node lifecycle hook with inline network fetch (malicious dependency)
// MITRE: T1195.002, T1059.007  | CONF: high  FP: med  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: native-module builds (node-gyp) that download toolchains
// TUNING: scope to user-writable repo/Temp paths; exclude vetted internal pkgs
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(postinstall|preinstall|prepare)/i
| CommandLine=/(curl\s|wget\s|Invoke-WebRequest|iwr\s|http:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|fetch\(|child_process)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine], limit=200)

// HUNT: developer process beaconing to public IP literal on odd port (C2 exfil)
// MITRE: T1071.001, T1041, T1105  | CONF: high  FP: med  COST: med
// REQUIRES: NetworkConnectIP4 (+ ProcessRollup2 for tree context)
// FALSE POSITIVES: local Vite dev server (5173) on private IPs — excluded below
// TUNING: confirm RemoteAddressIP4 is public; pin RemotePort to observed C2 ports
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(node|node\.exe|npm|curl|curl\.exe|powershell\.exe|pwsh\.exe|python3?|Code\.exe|cursor|wscript\.exe)$/i
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.|169\.254\.)/
| in(field="RemotePort", values=[5173, 1224, 3000, 8080, 8000, 5000])
| groupBy([aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=count())
| sort(_count, order=desc)

// HUNT: wallet-extension / browser credential store access by non-browser proc
// MITRE: T1555.003, T1539  | CONF: med  FP: med  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: backup agents, password managers, browser self-access
// TUNING: exclude vetted backup/PWM ImageFileNames; require dev-tool parent
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(Local Extension Settings|Login Data|nkbihfbeogaeaoehlefnkodbefgpgknn|bfnaelmomeimhlpmgjnjophhpkkoljpa|Solflare|metamask|Wallets|keystore)/i
| ImageFileName!=/\\(chrome\.exe|msedge\.exe|firefox\.exe|brave\.exe|opera\.exe)$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine], limit=200)

// HUNT: Run-key persistence pointing at interpreter in user/Temp path
// MITRE: T1547.001, T1053.005  | CONF: med  FP: med  COST: low
// REQUIRES: AsepValueUpdate / RegGenericValueUpdate
// FALSE POSITIVES: dev tools registering legitimate startup entries
// TUNING: restrict RegStringValue to Temp/Downloads/AppData repo paths
#event_simpleName=/AsepValueUpdate|RegGenericValueUpdate/
| RegObjectName=/\\Software\\Microsoft\\Windows\\CurrentVersion\\Run/i
| RegStringValue=/(node|python|pythonw|wscript|cscript|curl|powershell).*(\\Temp\\|\\Downloads\\|\\AppData\\)/i
| table([@timestamp, aid, ComputerName, RegObjectName, RegValueName, RegStringValue], limit=200)

// HUNT: python from user/Temp path with network/encoding verbs (InvisibleFerret)
// MITRE: T1059.006, T1027, T1105  | CONF: med  FP: high  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: normal developer python usage from project dirs
// TUNING: only triage when correlated with a Q3 C2 hit on the same aid
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/(python3?|pythonw?\.exe)$/i
| CommandLine=/(\\Temp\\|\\Downloads\\|\\AppData\\|\/tmp\/).*(urllib|requests|base64|socket|http:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine], limit=200)

// HUNT: git clone then editor/interpreter download on same host (lure chain)
// MITRE: T1204.002, T1105  | CONF: med  FP: med  COST: med
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: legitimate clone-and-build developer workflows
// TUNING: prioritize hosts whose download verb targets a public IP literal
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| case {
    CommandLine=/git\s+clone/i | marker := "clone";
    ParentBaseFileName=/^(Code\.exe|cursor|node|npm)$/i AND ImageFileName=/(curl|wget|powershell\.exe|wscript\.exe|bash|osascript)/i | marker := "exec";
    * | marker := "other";
  }
| marker!="other"
| groupBy([aid, ComputerName], function=collect([marker, CommandLine, ImageFileName], limit=20))
| CommandLine=/clone/ OR marker="exec"

Field note: All fields above are standard Falcon data-model fields. RemotePort values and the C2 port list reflect observed/likely Contagious Interview tasking ports — confirm port pins against your tenant's own dev traffic baseline before promoting Q3 to an alert.

Promote Q1, Q2 and Q3 to Custom IOAs scoped to a developer host group first (lower FP blast radius), validate for one detection cycle, then widen. Q4–Q7 remain Investigate-only hunts pending tenant baselining.

Grouped quick-copy blocks. Atomic indicators are point-in-time (cited §18); replace REPLACE_WITH_* placeholders only with hashes you confirm from a real source — do not fabricate.

type,value,action,severity,expiration,description,tags
ipv4,23.137.105.75,detect,high,2026-09-25,Contagious Interview BeaverTail/InvisibleFerret C2,campaign:ContagiousInterview
sha256,REPLACE_WITH_CONFIRMED_HASH,prevent,critical,2026-12-25,BeaverTail loader payload,campaign:ContagiousInterview
domain,REPLACE_WITH_CONFIRMED_VERCEL_SUBDOMAIN,detect,medium,2026-07-25,Actor payload staging,campaign:ContagiousInterview

# Parent-spawns-downloader (editor/npm => curl|wscript|powershell|osascript)
# npm/node lifecycle: postinstall|preinstall + (curl|iwr|IP-literal)
# Public IPv4 HTTP from node/curl/python on odd port (e.g. 5173)
# Non-browser read of: Login Data, Local Extension Settings, wallet ext IDs
# VS Code tasks.json runOn:folderOpen ; .githooks/pre-commit in cloned repo

# npm
dev-log-core logger-base logkitx pino-debugger debug-fmt debug-glitz
redeem-onchain-sdk nicegui period-newline terminal-logger-utils
terminal-logger-pack js-logger-pack node-env-resolve sleek-pretty
# PyPI
logutilkit apachelicense fluxhttp license-utils-kit
# Go
github.com/golangorg/formstash github.com/aokisasakidev/mit-license-pkg
# Rust crate: logtrace | Packagist: golangorg/logkit roberts/leads
# Malware: BeaverTail OtterCookie InvisibleFerret | Loaders: XORIndex HexEval

# VS Code: enable Workspace Trust (security.workspace.trust.enabled=true)
# Block tasks.json auto-run: security.workspace.trust.untrustedFiles=open
# npm: set ignore-scripts=true on dev images for untrusted clones
# Audit git config core.hooksPath on developer endpoints
# Egress: alert dev hosts => public IPv4-literal HTTP on non-standard ports

1 · VS Code Workspace Trust + disable folder-open tasks (managed settings.json)

// Deploy to %APPDATA%\Code\User\settings.json (Win) or
//   ~/Library/Application Support/Code/User/settings.json (macOS) via MDM/GPO
{
  "security.workspace.trust.enabled": true,
  "security.workspace.trust.startupPrompt": "always",
  "security.workspace.trust.untrustedFiles": "open",
  "task.allowAutomaticTasks": "off"
}

2 · Harden npm on developer images (disable lifecycle scripts for untrusted installs)

# System/user npmrc — block auto-run of pre/postinstall scripts
npm config set ignore-scripts true --global
# Verify
npm config get ignore-scripts        # expect: true
# For vetted internal builds, run install explicitly with scripts enabled:
#   npm ci --foreground-scripts --ignore-scripts=false   (in CI only)

3 · Audit git hooksPath across the dev fleet (PowerShell)

$paths = git config --show-origin --get-all core.hooksPath 2>$null
if ($paths) { Write-Warning "Non-default git hooksPath set:"; $paths }
else { Write-Output "core.hooksPath: default (no override)" }
# Flag any repo shipping its own .githooks/ + core.hooksPath override

4 · Egress block — dev hosts to public IP-literal HTTP on odd ports (firewall pseudo-rule)

# Proxy/NGFW: from DEV_WORKSTATION_GROUP
#   deny dst=PUBLIC and dst-port in {5173,1224,3000,8000,8080} and app=http/raw
#   log+alert matches; allowlist legitimate SaaS dev endpoints by FQDN only

Known gaps: clipboard-hijack and email-delivery detection sit outside Falcon endpoint telemetry — cover via browser/clipboard EDR signals and the mail-gateway hunt in §7. Persistence and InvisibleFerret hunts (Q5/Q6) are present but unpromoted pending tenant baselining (see §11 gates). Validation: do not promote any query to a blocking IOA until its §11 gate passes.