North Korean Hackers Pose as Recruiters to Backdoor Developers

North Korean threat actors are running a sophisticated social engineering operation that weaponizes job recruitment to compromise software developers. The campaign, tracked as Contagious Interview, has been active since December 2022 and continues targeting developers at cryptocurrency and AI companies through convincingly staged technical interviews.

Microsoft Defender Experts published detailed analysis of the operation this week, documenting how attackers exploit trust in recruitment workflows to deploy custom backdoors including OtterCookie and FlexibleFerret.

TL;DR

• What happened: North Korean actors pose as crypto/AI company recruiters and deliver malware through fake coding assessments
• Who's affected: Software developers, particularly those in enterprise, crypto, and AI sectors
• Severity: High - targets source code access, CI/CD pipelines, and production credentials
• Action required: Verify recruiter identities; never run untrusted code on development machines

How Contagious Interview Works

The campaign mirrors legitimate technical recruitment with uncomfortable accuracy. Attackers impersonate recruiters from cryptocurrency trading firms and AI solution providers, reaching out through professional networking platforms with job opportunities.

The process follows standard industry patterns:

1. Initial outreach: Recruiter contact via LinkedIn or email with job description
2. Technical screening: Discussion of skills and experience
3. Coding assessment: Request to clone and run a code repository
4. Follow-up: Additional "evaluation" tasks requiring code execution

The malicious moment comes during the coding assessment. Attackers instruct candidates to clone NPM packages hosted on GitHub, GitLab, or Bitbucket. These repositories contain legitimate-looking code with malicious dependencies that execute during installation.

What Gets Harvested

Developer machines represent high-value targets precisely because of what they contain. The Microsoft blog documents the malware harvesting:

• API tokens for cloud services
• Cloud provider credentials (AWS, GCP, Azure)
• Code signing keys
• Cryptocurrency wallet data
• Password manager artifacts
• Source code repositories

Access to a single developer endpoint can compromise entire CI/CD pipelines. With stolen signing keys, attackers could sign malicious code that appears legitimate. With cloud credentials, they gain access to production infrastructure.

This credential-harvesting focus aligns with patterns we've seen across North Korean operations. The GlassWorm VSCode extension attack we covered today uses similar techniques to steal developer credentials, though attribution differs.

VSCode Tasks Abuse

Recent variants of the campaign abuse Microsoft VSCode Tasks for persistence. After initial infection, malware configures .vscode/tasks.json to execute payloads whenever the developer opens the project folder.

This technique persists across system reboots and survives basic cleanup attempts. Developers who clone multiple repositories may not notice malicious task configurations buried in workspace settings.

Why Developers Fall for It

The campaign's effectiveness stems from its exploitation of standard industry practices. Technical interviews frequently involve coding assessments. Running untrusted code is normalized through take-home tests and technical challenges.

"The attack weaponizes legitimate recruitment workflows that developers encounter routinely," the Microsoft analysis notes. The social engineering doesn't require unusual requests—just the standard process executed by adversaries.

Attackers also leverage economic pressures. Developers seeking new opportunities may be less cautious when potential employers request code execution. The promise of a job at a well-known firm creates motivation to comply quickly.

Indicators of Contagious Interview

Red flags that suggest a malicious recruitment attempt:

• Recruiter profiles with limited history - New or sparsely connected LinkedIn accounts
• Urgency around code execution - Pressure to run assessments immediately
• Repositories requiring npm install - Legitimate assessments usually don't need external dependencies
• Executable code in ZIP attachments - Professional recruiters use established platforms
• Requests to disable security tools - "Turn off your antivirus for the assessment to work properly"

The campaign has evolved since 2022, adding new malware variants and refining social engineering tactics. Microsoft attributes Contagious Interview to North Korean threat actors with high confidence based on infrastructure overlaps and operational patterns.

Protecting Developer Endpoints

Organizations should implement layered defenses:

1. Dedicated assessment machines - Use isolated VMs or containers for coding challenges
2. Repository scanning - Analyze cloned code before execution with tools like Snyk or npm audit
3. Credential isolation - Don't store production credentials on machines used for interviews
4. Recruiter verification - Confirm recruiter identity through official company channels

For individual developers, the core principle is simple: treat coding assessments like malware samples. Run them in sandboxed environments with no access to real credentials or sensitive data.

The DOJ charges against ATM jackpotting operators demonstrate that even technically sophisticated attacks eventually lead to prosecutions. But North Korean state-sponsored operations face fewer legal consequences, making persistent campaigns like Contagious Interview likely to continue.

Why This Matters

Developer-targeted attacks have intensified across 2025 and 2026. Nation-state actors recognize that developer access translates to supply chain access. A single compromised developer at a widely-used library maintainer could enable attacks affecting thousands of downstream applications.

The normalization of remote work has expanded attack surface. Developers running code assessments at home often lack enterprise security controls. Personal machines may store credentials for multiple organizations and projects.

For security teams, protecting developers requires balancing security with productivity. Overly restrictive policies may push developers toward shadow IT practices that create greater risk. The goal is enabling safe assessment workflows rather than prohibiting necessary activities.