Contagious Interview: VS Code to RAT

This report documents the "Contagious Interview" campaign attributed to DPRK-affiliated actors that uses fake LinkedIn recruitment and Google Meet interviews to pressure developers to open a malicious GitHub repository; opening the repo in VS Code triggers an autorun task which starts a Next.js process that eval()s a staged JavaScript payload, resulting in a Node.js RAT that beacons to operator-controlled C2 servers, performs system fingerprinting, and enables remote code execution. The analysis includes code excerpts, infrastructure mapping (IPs, domains, endpoints), YARA detection, and actionable mitigations (disable automatic tasks, inspect .vscode and config files, monitor dev environment network traffic).