DPRK Malware Hiding in Microsoft VSCode Dictionary Files

This report documents a Lazarus Group supply-chain style campaign (“Contagious Interview”) that lures developers with fake job assessments and delivers a multi-stage JavaScript dropper hidden in VS Code files (.vscode/spellright.dict and tasks.json). The dropper creates a hidden ~/Programs_X64 directory, writes a main.js that beacons to a Vercel-hosted C2 (ip-regions-check.vercel.app) using a custom header, and executes arbitrary payloads via eval(response.data); the analysis includes deobfuscation details and IOCs (domain, IP 146.70.41.188, file paths, header, campaign ID).