North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads

Date (as written): 2026-04-07T21:36:45.870Z
Year: 2026

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Software developers, job seekers, and individuals possessing cryptocurrency or sensitive credentials. · 07/04/2026

Researchers at Socket identify North Korean threat actors spreading "Contagious Interview" malware across five open-source ecosystems. They impersonate developer tools to fetch staged payloads, steal credentials, and enable remote access. [Date Occurred: Since 2024; Date Discovered: During 2026]

https://www.hackmageddon.com/2026/04/24/1-15-april-2026-cyber-attacks-timeline/

https://docs.google.com/spreadsheets/d/e/2PACX-1vQ2r4m8VwOtuzK2FJuvkcNKKkg6xMvBiZ2EhovYv9UrG3HLCH6yZ9e0udWfTyL8Gkf3-M33jOAfC_rR/pub?gid=1060075184&single=true&output=csv

https://thehackernews.com/2026/04/n-korean-hackers-spread-1700-malicious.html

Socket.dev blog

North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads · 2026-04-07T21:36:45.870Z

Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.

https://socket.dev/blog/contagious-interview-campaign-spreads-across-5-ecosystems

Suggest a correction on GitHub