Contagious Interview: North Korean Hackers Target Crypto Devs with Fake Job NPM Malware
VPN Central [Unofficial]
February 23, 2026
North Korean actors execute Contagious Interview campaign targeting cryptocurrency, Web3, and AI developers. Fake job assessments deliver trojanized NPM packages installing BeaverTail and InvisibleFerret backdoors. Malware surgically replaces MetaMask extensions stealing wallet credentials. Threat actors hide JavaScript payloads in technical interview challenges. Developers execute malicious code during skills tests. Initial beacon contacts C2 retrieving encoded […]
The post Contagious Interview: North Korean Hackers Target Crypto Devs with Fake Job NPM Malware appeared first on VPN Central.
Discussion in the ATmosphere