Cybersecurity experts have uncovered a new wave of cyberattacks linked to North Korean threat actors targeting cryptocurrency wallets in an operation dubbed the “Contagious Interview” campaign.
The attackers employ sophisticated phishing tactics under the guise of job interviews, exploiting platforms like LinkedIn to target unsuspecting job seekers.
The campaign begins with victims being contacted by cybercriminals posing as recruiters. These individuals direct victims to fraudulent websites designed to impersonate legitimate recruitment platforms like the Willo candidate screening site.
After simulating a technical error, these fake sites prompt potential victims to download a malicious “fix.” Once executed, this script delivers a payload containing malware aimed at draining cryptocurrency wallets.
The campaign has been active since late 2024, with experts warning of its implications for victims across multiple operating systems, including Windows, macOS, and Linux.
Notably, the attackers use cross-platform tools such as Golang to execute their malicious code.
The malicious payload, often distributed as a ZIP file named VCam_intel.zip, includes a range of tools aimed at persistent system infection and data theft.
The malware employs a sophisticated approach, combining shell scripts and Golang-based programs to deploy a backdoor and a credential-stealing mechanism.
One notable component, ChromeUpdateAlert.app, is designed specifically for macOS and mimics a legitimate Chrome update process to deceive users and steal credentials.
It displays a fake microphone permission alert, prompting victims to enter their system password, which is then exfiltrated to the attackers using Dropbox.
The malware’s key functions include the ability to exfiltrate sensitive files, such as cryptocurrency wallet data, and execute shell commands remotely, providing attackers with significant control over the compromised system.
It also modifies Chrome browser preferences, likely to facilitate the deployment of malicious extensions targeting the MetaMask wallet.
Additionally, the malware is capable of extracting Chrome cookies, passwords, and macOS Keychain data, enabling attackers to access stored credentials and other sensitive information.
This highlights the importance of maintaining strong security practices, including scrutinizing unexpected permission requests and keeping security tools updated.
The malware operates via a persistent service registered on the host system and communicates with its command-and-control (C2) server to execute various commands.
The primary objective of this campaign appears to be cryptocurrency theft. The attackers seek to harvest cryptocurrency wallet data by targeting applications like MetaMask.
This effort aligns with broader North Korean state-sponsored campaigns aimed at funding their regime through cybercrime.
Numerous reports estimate that North Korea has stolen billions in cryptocurrency over the past several years.
Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free
Security researchers, including @tayvano_ and @500mk500, played a vital role in identifying the domains and hashes associated with this campaign.
The malicious domains, such as api.camera-drive[.]cloud and api.nvidia-cloud[.]online, were used to host and distribute the infected payloads.
The malware exhibits sophisticated capabilities, including architecture detection and cross-platform compatibility.
Further analysis of the malware revealed the use of previously known malicious domains and tactics, such as those linked to trojanized npm packages.
These connections highlight the evolution and adaptability of North Korean-affiliated cybercrime campaigns.
The malware’s Golang code contains several advanced features:
To stay protected, experts recommend:
For organizations and individuals handling cryptocurrencies, vigilance is imperative to navigate this complex threat landscape.
Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!
Cybercriminals have developed PhishWP, a malicious WordPress plugin, to facilitate sophisticated phishing attacks, which enable…
FireScam is multi-stage malware disguised as a fake “Telegram Premium” app that steals data and…
Over the past year, malicious actors have been abusing OAST services for data exfiltration, C2…
A phishing campaign spoofing the United States Social Security Administration emerged in September 2024, delivering…
The Kaspersky researchers investigation into the EAGERBEE backdoor revealed its deployment within Middle Eastern ISPs…
CyTwist, a leader in advanced next-generation threat detection solutions, has launched its patented detection engine…