Contagious Interview: VS Code to RAT
ID: 93ce4cfd-8b1f-5c77-bdaa-cce31dd0eea7
STIX ID: report--93ce4cfd-8b1f-5c77-bdaa-cce31dd0eea7
Feed Name: Ransomware ISAC Blog
Date Published: 2026-03-16
Date Updated: 2026-07-28
Author: [email protected] (François-Julien Alcaraz & Yashraj Solanki)
**Executive summary:** A DPRK-linked campaign dubbed the “Contagious Interview” uses fake LinkedIn recruitment and pressured technical interviews to get developers to open a malicious GitHub repository; VS Code automatic tasks and a Next.js config then auto-run code that fetches a staged RAT from Vercel/C2 hosts, enabling periodic beaconing, system fingerprinting and operator-driven remote code execution—IoCs, infrastructure pivots, YARA and mitigation guidance are provided.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.