kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

Contagious Interview

also tracked as jade sleet 1, tradertraitor 1, unc4899 1, dprk 1, north korea 1

4 stories · 4 in the wild · July 5, 2026 – November 8, 2026

evidence: 4 observed

how they got in

  • package registry 2 · Aug 4
  • fake recruiter 1 · Nov 8
  • browser extension 1 · Jul 5

sectors

  • developers 2 · Aug 4
  • finance 1 · Nov 8
  • government 1 · Jul 26

geography

  • north korea 2 · Aug 4

malware and tools

  • ether hiding 1 · Aug 4
  • nullreceiver 1 · Aug 4
  • ottercookie 1 · Jul 26

techniques

  • fake recruiter 1 · Nov 8
  • supply chain 1 · Nov 8
  • command and control 1 · Aug 4

attack phases seen

  • Initial access 2 · Nov 8
  • Execution 2 · Jul 26
  • Persistence 1 · Nov 8
  • Command and control 1 · Aug 4

what we reported, newest first, grouped by story

Oct 30 – November 8, 2026

  • New profiling separates TraderTraitor from higher-volume job-lure crews. Security Alliance argues that TraderTraitor/Jade Sleet/UNC4899 uses fake interviews as an entry point but differs from Contagious Interview through careful target selection, multi-employee pressure and infrastructure-focused operations involving front-company repositories and trojanized Terraform providers. Binance still has not released meaningful technical indicators (earlier coverage). · Nov 8 · observed · via fake recruiter · as tradertraitor, jade sleet, unc4899 · Threat Activity & Operations

August 4, 2026

  • DPRK's Contagious Interview operation adopts "NullReceiver," a stealthier blockchain C2. Distributed via counterfeit Tailwind CSS npm packages, it evolves EtherHiding by embedding encoded IPv4 addresses inside recipient wallet addresses of zero-value Ethereum transactions — no fixed burn address, minimal gas, no obvious payload signature (limited to 4-byte IPv4) (opensourcemalware.com). · Aug 4 · observed · via package registry · as dprk · Threat Activity

Jul 4 – July 5, 2026

  • North Korea's PolinRider campaign publishes 108 malicious packages/extensions across npm, Packagist, Go, and the Chrome Web Store, linked to the ongoing Contagious Interview cluster. Compromised maintainer accounts mean the count is expected to grow. The Hacker News · Jul 5 · observed · via package registry · as north korea · Threat Activity