The persistent North Korea-linked campaign, also known as Contagious Interview, has expanded its reach by disseminating harmful packages that target the Go, Rust, and PHP systems.

“The attacker’s packages were made to look like genuine developer tools […], while secretly works as malware launchers. This extends Contagious Interview’s strategy into a collaborative supply chain attack across multiple platforms,” said Socket security researcher Kirill Boychenko in a report released on Tuesday.

Here is a complete list of the packages identified:

• npm: dev-log-core, logger-base, logkitx, pino-debugger, debug-fmt, debug-glitz
• PyPI: logutilkit, apachelicense, fluxhttp, license-utils-kit
• Go: github[.]com/golangorg/formstash, github[.]com/aokisasakidev/mit-license-pkg
• Rust: logtrace
• Packagist: golangorg/logkit

These launchers are created to retrieve second-stage payloads for specific platforms. These payloads turn out to be malware capable of stealing information and providing remote access. It mainly focuses on collecting data from web browsers, password managers, and cryptocurrency wallets.

However, the Windows version of the malware delivered through “license-utils-kit” has what Socket calls a “full post-compromise implant.” This implant can run shell commands, record keystrokes, steal browser data, upload files, close web browsers, use AnyDesk for remote access, create an encrypted archive, and download more modules.

“This makes this group important, not only because it reaches across multiple platforms, but also because of how much post-compromise functionality is included in at least part of the campaign,” Boychenko added.

What makes the most recent group of libraries interesting is that the harmful code isn’t activated during the installation process. Instead, it’s included in functions that look legitimate and match the package’s intended purpose. For example, in “logtrace,” the code is hidden inside “Logger::trace(i32),” a method that a developer probably wouldn’t suspect.

The spread of Contagious Interview across five open-source platforms shows that the campaign is a well-funded and ongoing supply chain threat. It’s designed to systematically infiltrate these platforms as initial ways to get into developer environments for spying and financial gain.

In total, Socket said that it had found over 1,700 malicious packages related to the activity since the beginning of January 2025.

This discovery is part of a larger software supply chain attack led by North Korean hacking groups. This includes the infiltration of the popular Axios npm package to distribute an implant called WAVESHAPER.V2. They gained control of the package maintainer’s npm account through a targeted social engineering campaign.

The attack has been attributed to a financially motivated attacker known as UNC1069, which is linked to BlueNoroff, Sapphire Sleet, and Stardust Chollima. Security Alliance (SEAL), in a report released today, mentioned that it blocked 164 domains connected to UNC1069 that impersonated services like Microsoft Teams and Zoom between February 6 and April 7, 2026.

“UNC1069 runs multi-week social engineering campaigns with low pressure across Telegram, LinkedIn, and Slack. They either impersonate known contacts or credible brands, or they use access to previously compromised company and individual accounts to send out a fake Zoom or Microsoft Teams meeting link,” SEAL said.

These fake meeting links are used to present ClickFix-like lures, which leads to the execution of malware. The malware then connects to an attacker-controlled server to steal data and carry out targeted post-exploitation activity on Windows, macOS, and Linux.

“Operators intentionally wait before taking action after gaining initial access. The implant remains dormant or passive for some time,” SEAL added. “The target usually reschedules the failed call and continues as usual, unaware that their device has been compromised. This patience extends the amount of time they have to operate and maximizes the value gained before any incident response is triggered.”

In a statement shared with The Hacker News, Microsoft stated that financially driven North Korean attackers are constantly improving their tools and infrastructure. They’re using domains that look like they belong to financial institutions in the U.S. and video conferencing applications to conduct social engineering attacks.

“We consistently see ongoing changes in how DPRK-linked, financially motivated actors operate, including shifts in their tools, infrastructure, and targeting. However, their behavior and intent remain clearly consistent,” said Sherrod DeGrippo, general manager for threat intelligence at Microsoft.