The North Korean hacking group behind the Contagious Interview campaign, also known as WaterPlum, is linked to the StoatWaffle malware family, which is spread through infected Microsoft Visual Studio Code (VS Code) projects.

Using VS Code’s “tasks.json” file to distribute malware is a fairly recent technique used by the attackers since late 2025. These attacks exploit the “runOn: folderOpen” feature to automatically start the malicious code whenever project files are opened in VS Code.

“The task is designed to download data from a Vercel-hosted web application, regardless of the operating system,” NTT Security stated in a recent report. “While this analysis focuses on Windows, the core actions remain the same across different operating systems.”

The downloaded malware first checks for Node.js. If it’s missing, the malware downloads and installs it from the official website. Then, it launches a downloader that repeatedly contacts a remote server for another downloader, which repeats this process by connecting to a different endpoint on the same server and running the received code as Node.js code.

StoatWaffle has been observed delivering two distinct modules:

• A data-stealing module that extracts credentials and extension data from web browsers (Chromium-based and Firefox) and sends them to a command-and-control (C2) server. On macOS systems, it also steals the iCloud Keychain database.
• A remote access trojan (RAT) that communicates with the C2 server to receive and execute commands on the compromised machine. These commands allow the malware to change directories, list files, run Node.js code, upload files, search directories recursively for specific keywords, execute shell commands, and self-terminate.

“StoatWaffle is a modular malware built with Node.js, including Stealer and RAT components,” the security firm said. “WaterPlum is continuously creating new malware and updating existing ones.”

This activity aligns with other campaigns from the same attacker that target the open-source community:

• A collection of malicious npm packages distributing the PylangGhost malware, marking the first time the Python backdoor has been spread through npm packages.
• A campaign called PolinRider has inserted malicious, obfuscated JavaScript code into many public GitHub repositories, leading to the deployment of a new version of BeaverTail, a well-known stealer and downloader associated with Contagious Interview.
• Compromises include four repositories within the Neutralinojs GitHub organization. The attacker likely compromised the GitHub account of a long-time Neutralinojs contributor with organization-level write access to force-push JavaScript code that retrieves encrypted payloads in Tron, Aptos, and Binance Smart Chain (BSC) transactions to download and run BeaverTail. Victims were likely infected through a malicious VS Code extension or an npm package.

Microsoft, in its analysis of Contagious Interview this month, noted that the threat actors gain access to developer systems through “convincing fake recruitment processes” resembling real technical interviews. This leads victims to execute malicious commands or packages from GitHub, GitLab, or Bitbucket as part of the evaluation.

In some instances, potential victims are contacted via LinkedIn. The targets are not entry-level developers but founders, CTOs, and senior engineers in the cryptocurrency or Web3 space, who typically possess extensive access to organizational tech infrastructure and cryptocurrency wallets. A recent instance involved an unsuccessful attempt to target the founder of AllSecure.io through a fraudulent job interview.

Key malware families used in these attacks include OtterCookie (a backdoor capable of significant data theft), InvisibleFerret (a Python-based backdoor), and FlexibleFerret (a modular backdoor available in both Go and Python). While InvisibleFerret usually arrives via BeaverTail, recent breaches have shown it being deployed as a secondary payload after initial access is gained via OtterCookie.

It’s important to note that FlexibleFerret is also known as WeaselStore. Its Go and Python versions are called GolangGhost and PylangGhost, respectively.

Indicating the attackers’ ongoing refinement of their techniques, newer versions of the malicious VS Code projects have replaced Vercel-based domains with GitHub Gist-hosted scripts for downloading and running subsequent payloads, which ultimately lead to the deployment of FlexibleFerret. These VS Code projects are hosted on GitHub.

“By embedding malicious code directly into tools, coding exercises, and assessment workflows trusted by developers, threat actors capitalize on the trust job seekers place in the hiring process during periods of high motivation and time pressures, which lowers suspicion and resistance,” the tech company stated.

In response to the misuse of VS Code Tasks, Microsoft added a mitigation in the January 2026 update (version 1.109), implementing a new “task.allowAutomaticTasks” setting, defaulting to “off” to increase security and prevent unintended execution of tasks specified in “tasks.json” when a workspace is opened.

“The update also blocks the setting from being set at the workspace level, meaning malicious repositories can not override the user’s (global) setting via their own .vscode/settings.json file,” Abstract Security reported. 

“This version and the more recent February 2026 (version 1.110) release also includes a secondary prompt that alerts the user when an auto-run task is discovered in a newly opened workspace. This will serve as another safety measure after a user approves of Workspace Trust.”

Recently, North Korean actors have also been conducting coordinated malware campaigns targeting cryptocurrency professionals through LinkedIn social engineering, using fake venture capital firms, and utilizing malicious video conferencing links. These activities are connected to groups tracked as GhostCall and UNC1069.

“The attack chain culminates in a fake CAPTCHA page similar to distribution methods used by ClickFix that tricks victims into executing commands injected into the clipboard within their Terminal,” MacPaw’s Moonlock Lab said. “Designed for both macOS and Windows, the campaign uses cross-platform tactics in order to distribute payloads.”

These details emerged as the U.S. Department of Justice (DoJ) announced the sentences for three men – Audricus Phagnasay, 25, Jason Salazar, 30, and Alexander Paul Travis, 35 – for aiding North Korea’s fraudulent information technology (IT) worker scheme, thereby violating international sanctions. All three had previously pleaded guilty in November 2025.

Phagnasay and Salazar each received three years probation and a $2,000 fine. They were also ordered to forfeit the profits gained through the wire fraud conspiracy. Travis was sentenced to one year in prison and ordered to forfeit $193,265, the sum made by North Koreans utilizing his identity.

“These men effectively handed over the keys to North Korean technology workers to raise illicit revenues for the North Korean government – all to them for the purpose of what they saw as easy money in return,” Margaret Heap, U.S. Attorney for the Southern District of Georgia, indicated in a statement.

Last week, Flare and IBM X-Force published a detailed overview of the IT worker operation and its internal mechanisms while explaining how IT workers study at top-tier universities within North Korea and pass through a demanding interview process ahead of their involvement in the scheme.

They are “considered elite members of North Korean society that has become an indispensable part of the North Korean government’s objectives,” that is “revenue generation, remote employment activity, theft of corporate and proprietary information, extortion, the support for other North Korean groups.”