Contagious Interview

Contagious Interview has registered domains to leverage in their social engineering campaigns.^[4][5][8] Contagious Interview has also registered domains to utilize for C2.^{[9][12][1][13][14][15]}

Contagious Interview has acquired virtual private servers from services such as Stark Industries Solutions and RouterHosting.^[2][7] Contagious Interview has also utilized hosting providers to include Tier[.]Net, Majestic Hosting, Leaseweb Singapore, and Kaopu Cloud.^[4]

Contagious Interview has used web services such as Dropbox to receive stolen data and Google Drive, Firebase, GitHub, and Telegram to disseminate files.^[12][4] Contagious Interview has also used a cloud platform such as Vercel for C2 operations leveraging malicious web applications and static pages.^[13][14][15] Contagious Interview has also used Slack to coordinate their activities.^[9]

Contagious Interview has established persistence using InvisibleFerret malware to create a .desktop entry to run on startup on GNOME-based Linux devices.^[6]

Contagious Interview has targeted macOS victim hosts using a bash downloader coremedia.sh and a bash script cloud.sh.^[12]

Contagious Interview has utilized Visual Basic scripts in the execution of their downloader malware targeting Windows devices including as script called update.vbs.^[12]

Contagious Interview has used the Python-based malware such as InvisibleFerret to install and execute Python Packages and Python modules.^[2][5][7]

Contagious Interview has leveraged JavaScript in the execution of their downloader malware targeting Windows devices using a NodeJS script titled nvidia.js.^[12]

Contagious Interview has developed malware that utilizes Qt cross-platform framework to include BeaverTail.^[5][8]

Contagious Interview has created fake social media accounts such as LinkedIn and Telegram accounts for their targeting efforts.^{[4][5][16][17][8][6]}

Contagious Interview has created fake email accounts to correspond with social media accounts, fake LinkedIn personas, code repository accounts, and job announcements on development job board services.^{[9][4][15][5][6][8]} Contagious Interview has also utilized fake email accounts with Threat Intelligence vendor services.^[9]

Contagious Interview has exfiltrated stolen passwords to Dropbox.^[12]

Contagious Interview has used hexadecimal string encoding to hide critical JavaScript module names, function names, and C2 URLs, which are decoded dynamically at runtime.^[13]

Contagious Interview has appeared to have used AI to generate images and content to facilitate their campaigns.^[4]

Contagious Interview had identified and solicited victims through social media such as LinkedIn, X, and Telegram.^{[12][1][16][17][7][8]}

Contagious Interview had identified and solicited victims through code repositories such as GitHub.^[7]

Contagious Interview has distributed malicious files requiring direct victim interaction to execute through the guise of a code test.^[16][17]

Contagious Interview has leveraged ClickFix type tactics enticing victims to copy and paste malicious code.^[9][12][1]

Contagious Interview has relied on users to install a malicious library from a code repository to infect the victim's device and has led to additional payload distribution and theft of sensitive data.^{[9][1][2][13][14][15][5][11][6][7]}