[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6dXFK8SZr-hn8guIKmfLcjMmVPCaWDNSd7_lag5IhYs":3},{"article":4,"iocs":53,"watch_terms":73,"solutions":74,"lesson":165},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"0238dd87-6e76-4773-a9ba-b1565eaf2b16","Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto","contagious-interview-campaign-compromises-30-000-devices-steals-10-71m-in-crypto-c533ab","The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets, according to a new joint cybersecurity advisory. The primary targets of the campaign are individual web designers, engineers, and specialists in cryptocurrency,","North Korean threat actors, operating under the 'Contagious Interview' campaign, have compromised over 30,000 devices globally, stealing at least $10.71 million in cryptocurrency. The campaign targets web designers, engineers, and crypto specialists by posing as recruiters on social media, leading victims through a fake job assessment that deploys malware.","North Korean actors compromised 30,000 devices, stealing $10.71M in crypto via job scam.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcontagious-interview-campaign.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjjuVP0IzjchtSeuT6WwQHPupLynSiYhe7KinKtQVVE_EgFE5iG9SWV4HrgseuXaSUo-TaamFPzHl6SCnUPsbz29nzEo1BJeZVE4VB43KdMBmKEld7snbryRJIeIIAmiRZNEhFCJ-58klU6qGrvwg2Hn26FtkHv1s4cAj_zX9AWmdeym2-d4hScWr9dLiOY\u002Fs1600\u002Fexec.jpg","2026-09-21T17:19:00+00:00","2026-09-21T20:00:30.045883+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"WaterPlum","threat_actor",{"name":21,"type":19},"PurpleDelta",{"name":23,"type":19},"Wagemole",{"name":25,"type":19},"Famous Chollima",{"name":27,"type":19},"Void Dokkaebi",{"name":29,"type":19},"Gwisin Gang","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,59,61,63,65,67,69,71],{"type":47,"value":55,"context":56},"BeaverTail","Malware family deployed in the Contagious Interview campaign.",{"type":47,"value":58,"context":56},"InvisibleFerret",{"type":47,"value":60,"context":56},"FlexibleFerret",{"type":47,"value":62,"context":56},"GolangGhost",{"type":47,"value":64,"context":56},"PylangGhost",{"type":47,"value":66,"context":56},"OtterCookie",{"type":47,"value":68,"context":56},"RATatouille",{"type":47,"value":70,"context":56},"OtterCandy",{"type":47,"value":72,"context":56},"StoatWaffle",[],{"controls":75,"vendors":158},[76,105,134],{"slug":77,"name":78,"problem":79,"products":80},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":135,"name":136,"problem":137,"products":138},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[139,144,151],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":140,"product_name":141,"url":142,"description":143},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":135,"product_name":148,"url":149,"description":150},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":152,"product_name":155,"url":156,"description":157},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[159],{"slug":160,"name":161,"logo_path":162,"roles":163},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[164],"reported_by",{"slug":166,"title":167,"body":168,"framework_refs":169,"framework_notes":181},"fake-job-recruiters-drain-1071m-in-crypto-via-malware-campaign","Fake Job Recruiters Drain $10.71M in Crypto via Malware Campaign","The 'Contagious Interview' campaign exploited human trust and professional ambition by impersonating recruiters on social media platforms, luring victims into executing malware disguised as a legitimate job assessment. The root failure is a lack of security awareness among targeted professionals — web designers, engineers, and crypto specialists — who did not scrutinize the authenticity of recruitment contacts or the software they were asked to run. This is also a supply chain risk, as compromising individual contributors can cascade into broader organizational breaches. With 30,000 devices compromised and over $10 million stolen, the scale demonstrates that social engineering remains one of the most effective and underestimated attack vectors. Organizations must treat unsolicited recruitment activity as a potential threat vector and train employees accordingly.",[170,171,172,173,174,175,176,177,178,179,180],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 10 – Malware Defenses","CIS Control 2 – Inventory and Control of Software Assets","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SA-12 – Supply Chain Risk Management","NIST CSF ID.SC-2 – Supply Chain Risk Identification","MITRE ATT&CK T1566.003 – Phishing via Service (Social Media)","MITRE ATT&CK T1204 – User Execution","ISO\u002FIEC 27001 A.6.1 – Human Resource Security","GDPR Article 32 – Security of Processing (where EU data subjects are affected)",{}]