A Comprehensive Analysis of DPRK's Contagious Interview

This analysis documents a three-stage DPRK-operated supply-chain campaign targeting software developers: a malicious npm package used in social-engineered 'interviews' installs a JavaScript loader that connects to Socket.IO C2s to harvest browser and cloud credentials and download a second-stage OtterCookie backdoor, which in turn retrieves a PyInstaller-compiled InvisibleFerret payload; the combined toolset enables credential theft (including DPAPI/keychain decryption), cryptocurrency wallet theft, system-wide keylogging, persistent remote access, and multi-channel exfiltration. The report includes file hashes, C2 IPs and ports, persistence artifacts, targeted file paths, and recommended developer-focused mitigations and detection/hardening controls.