Summary:
This new activity cluster leverages deceptive LinkedIn job offers and is a part of the North Korea-sponsored Contagious Interview operation, primarily targeting individuals in the cryptocurrency and travel industries, to deploy cross-platform malware capable of compromising Windows, macOS, and Linux systems. The attack vector exploits victims’ trust to lure them with promises of remote work and attractive compensation, then manipulates them through a seemingly legitimate "hiring process." This process often involves requests for CVs and GitHub repository links, which are then used for performing reconnaissance on the victim and to establish a facade of the interview process’ credibility. The attackers then share links to malicious repositories, often hosted on GitHub or Bitbucket, containing seemingly innocuous decentralized exchange (DEX) projects.

Hidden within the code is an obfuscated script designed to retrieve a multi-stage payload. This payload includes a cross-platform JavaScript information stealer targeting cryptowallet extensions, demonstrating a clear financial motive. This stealer doubles as a loader for a Python-based backdoor with capabilities for clipboard monitoring, persistent remote access, and further malware deployment.

Security Officer Comments:
This campaign exhibits strong overlaps with the known "Contagious Interview" activity cluster, also tracked as DeceptiveDevelopment and DEV#POPPER. While similarities exist, the Lazarus Group continues to adapt and refine its tactics, evidenced by variations in the JavaScript stealer (distinct from previously observed BeaverTail samples) and other modifications to the infection chain. This highlights the group's commitment to continuous improvement and underscores the need for ongoing vigilance. The final payload delivered is a .NET binary capable of establishing a TOR proxy connection to a C2 server, exfiltrating system information, and deploying additional malware. This final stage often includes keylogging, data exfiltration, and the deployment of cryptocurrency miners, further emphasizing the attackers' financial motives. The multi-layered, multi-language nature of the malware, including complex Python scripts, JavaScript stealers, and .NET-based stagers, demonstrates a high level of technical sophistication.

Suggested Corrections:

Bitdefender Recommendations:
As social platforms increasingly become hotspots for malicious activities, vigilance is essential. Here are some red flags and measures to protect yourself:

Red Flags:

• Vague job descriptions: No corresponding job posting on the platform.
• Suspicious repositories: Belong to users with random names and lack proper documentation or contributions.
• Poor communication: Frequent spelling errors and refusal to provide alternative contact methods, such as corporate emails or phone numbers.

Best Practices:

• Avoid running unverified code: Use virtual machines, sandboxes, or online platforms to test code safely.
• Verify authenticity: Cross-check job offers with official corporate websites and confirm email domains.
• Adopt a cautious mindset: Scrutinize unsolicited messages and requests for personal information.

Organizations can make APT groups’ lives more difficult. Here’s how:

• Defense-in-depth strategy: A comprehensive defense-in-depth strategy is crucial to combat APTs. This includes implementing multiple layers of security controls, such as strong perimeter defenses, network segmentation, endpoint protection, intrusion detection systems, data encryption, access controls, and continuous monitoring for anomalies.
• Threat intelligence and sharing: Ideally, organizations should actively participate in threat intelligence sharing communities and collaborate with industry peers, government agencies, and security vendors. Sharing information about APTs and their techniques can help detect and mitigate attacks more effectively.
• Employee education and awareness: Regular security awareness programs, phishing simulations, and training sessions can educate employees about the latest threats, social engineering techniques, and safe computing practices.
• Incident response and recovery: Despite preventive measures, organizations should have a well-defined incident response plan. This includes incident detection, containment, eradication, and recovery procedures to minimize the impact of APT attacks and restore normal operations.

Link(s):
https://thehackernews.com/2025/02/cross-platform-javascript-stealer.html

https://www.bitdefender.com/en-us/blog/labs/lazarus-group-targets-organizations-with-sophisticated-linkedin-recruiting-scam