DPRK Contagious Interview Malware Weaponizes Microsoft VSCode Tasks

This report details a Lazarus Group (DPRK) 'Contagious Interview' campaign that lures software developers to clone malicious Git repositories containing .vscode/tasks.json which execute platform-specific loaders to install BeaverTail (JS) and Invisible Ferret (Python) payloads; the malware exfiltrates browser credentials and at least 43 crypto wallet extensions, maintains persistence via VSCode folderOpen tasks, communicates with active C2 infrastructure (notably 146.70.41.188 and multiple Vercel-hosted endpoints), and is observed across numerous GitHub/Bitbucket repositories and variants with provided IOCs and file hashes.