A sophisticated North Korean advanced persistent threat (APT) group known as “Contagious Interview” has established elaborate fake cryptocurrency consulting companies to target job seekers with specialized malware. Their investigation revealed the threat actors heavily utilize AI-generated images to create convincing “employee” profiles across multiple platforms, including LinkedIn, where the fake companies maintain active presences complete with falsified work histories and client testimonials. The group, a subunit of the infamous North Korean state-sponsored Lazarus Group, has created three front companies—BlockNovas LLC, Angeloper Agency, and SoftGlide LLC—to distribute malware through deceptive job interview processes. To avoid falling victim to such attacks, cybersecurity experts recommend scrutinizing job offers thoroughly, never executing code from unknown sources during interviews, and using dedicated devices for cryptocurrency management. The malware specifically targets cryptocurrency wallets, including MetaMask, BNB Chain, Coinbase, TronLink, Phantom, Crypto.com, and Coin98. Job applicants who engage with these fraudulent companies are unknowingly exposed to a trio of malware strains: BeaverTail, InvisibleFerret, and OtterCookie. Silent Push threat analysts uncovered this elaborate scheme after identifying unusual configurations in BeaverTail malware samples. This innocent-looking code actually fetches and executes the BeaverTail JavaScript malware, which subsequently downloads InvisibleFerret, a Python-based backdoor. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. These malicious tools are specifically designed to steal cryptocurrency wallet credentials, browser data, and provide backdoor access to victim machines. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 25 Apr 2025 08:45:05 +0000