The North Korean menace actors behind the continuing Contagious Interview marketing campaign are spreading their tentacles on the npm ecosystem by publishing extra malicious packages that ship the BeaverTail malware, in addition to a brand new distant entry trojan (RAT) loader.
“These newest samples make use of hexadecimal string encoding to evade automated detection techniques and guide code audits, signaling a variation within the menace actors’ obfuscation strategies,” Socket safety researcher Kirill Boychenko mentioned in a report.
The packages in query, which have been collectively downloaded greater than 5,600 instances previous to their removing, are listed beneath –
- empty-array-validator
- twitterapis
- dev-debugger-vite
- snore-log
- core-pino
- events-utils
- icloud-cod
- cln-logger
- node-clog
- consolidate-log
- consolidate-logger
The disclosure comes almost a month after a set of six npm packages have been found distributing BeaverTail, a JavaScript stealer that is additionally able to delivering a Python-based backdoor dubbed InvisibleFerret.
The tip aim of the marketing campaign is to infiltrate developer techniques beneath the guise of a job interview course of, steal delicate information, siphon monetary property, and keep long-term entry to compromised techniques.
The newly recognized npm libraries masquerade as utilities and debuggers, with certainly one of them – dev-debugger-vite – utilizing a command-and-control (C2) deal with beforehand flagged by SecurityScorecard as utilized by the Lazarus Group in a marketing campaign codenamed Phantom Circuit in December 2024.
What makes these packages stand out is a few of them, corresponding to events-utils and icloud-cod, are linked to Bitbucket repositories, versus GitHub. Moreover, the icloud-cod bundle has been discovered to be hosted inside a listing named “eiwork_hire,” reiterating the menace actor’s use of interview-related themes to activate the an infection.
An evaluation of the packages, cln-logger, node-clog, consolidate-log, and consolidate-logger, has additionally uncovered minor code-level variations, indicating that the attackers are publishing a number of malware variants in an try to extend the success fee of the marketing campaign.
Whatever the adjustments, the malicious code embedded throughout the 4 packages features as a distant entry trojan (RAT) loader that is able to propagating a next-stage payload from a distant server.
“The Contagious Interview menace actors proceed to create new npm accounts and deploy malicious code throughout platforms just like the npm registry, GitHub, and Bitbucket, demonstrating their persistence and exhibiting no indicators of slowing down,” Boychenko mentioned.
“The superior persistent menace (APT) group is diversifying its techniques — publishing new malware beneath contemporary aliases, internet hosting payloads in each GitHub and Bitbucket repositories, and reusing core elements like BeaverTail and InvisibleFerret alongside newly noticed RAT/loader variant.”
BeaverTail Drops Tropidoor
The invention of the brand new npm packages comes as South Korean cybersecurity firm AhnLab detailed a recruitment-themed phishing marketing campaign that delivers BeaverTail, which is then used to deploy a beforehand undocumented Home windows backdoor codenamed Tropidoor. Artifacts analyzed by the agency present that BeaverTail is getting used to actively goal builders in South Korea.
The e mail message, which claimed to be from an organization referred to as AutoSquare, contained a hyperlink to a mission hosted on Bitbucket, urging the recipient to clone the mission regionally on their machine to evaluation their understanding of this system.
The applying is nothing however an npm library that incorporates BeaverTail (“tailwind.config.js”) and a DLL downloader malware (“automobile.dll”), the latter of which is launched by the JavaScript stealer and loader.
Tropidoor is a backdoor “working in reminiscence by the downloader” that is able to contacting a C2 server to obtain directions that make it potential to exfiltrate recordsdata, collect drive and file info, run and terminate processes, seize screenshots, and delete or wipe recordsdata by overwriting them with NULL or junk information.
An vital facet of the implant is that it instantly implements Home windows instructions corresponding to schtasks, ping, and reg, a function beforehand additionally noticed in one other Lazarus Group malware referred to as LightlessCan, itself a successor of BLINDINGCAN (aka AIRDRY aka ZetaNile).
“Customers ought to be cautious not solely with e mail attachments but in addition with executable recordsdata from unknown sources,” AhnLab mentioned.
