← threat actors
threat actor · not yet in the cluster map
dprk
also tracked as contagious interview 1
5 stories · 5 in the wild · July 18, 2026 – August 4, 2026
evidence: 4 observed · 1 attempted
how they got in
- package registry 3 · Aug 4
- fake recruiter 1 · Jul 22
- supply chain 1 · Jul 18
malware and tools
- ether hiding 1 · Aug 4
- nullreceiver 1 · Aug 4
- golangghost 1 · Jul 22
- pylangghost 1 · Jul 22
- vectormark 1 · Jul 22
- contagious interview 1 · Jul 18
techniques
- command and control 1 · Aug 4
- credential theft 1 · Jul 22
- injection 1 · Jul 22
- malware distribution 1 · Jul 22
- phishing 1 · Jul 22
- supply chain 1 · Jul 22
- credential access 1 · Jul 18
attack phases seen
- Initial access 4 · Jul 22
- Credential access 2 · Jul 22
- Execution 2 · Jul 22
- Command and control 1 · Aug 4
- Exfiltration 1 · Jul 18
what we reported, newest first, grouped by story
August 4, 2026
- DPRK's Contagious Interview operation adopts "NullReceiver," a stealthier blockchain C2. Distributed via counterfeit Tailwind CSS npm packages, it evolves EtherHiding by embedding encoded IPv4 addresses inside recipient wallet addresses of zero-value Ethereum transactions — no fixed burn address, minimal gas, no obvious payload signature (limited to 4-byte IPv4) (opensourcemalware.com).
· Aug 4 · observed · via package registry · as contagious interview · Threat Activity
Jul 21 – July 22, 2026 · 2 reports
- The DPRK npm supply-chain campaign added more packages, with Nextron flagging
vectormark v1.0.0 and rollup-packages-polyfill-core v0.13.9 (which silently installs vectormark). The three-stage, RC4-encrypted payload pulls obfuscated JS from api[.]avax-test[.]dev and steals SSH keys, AWS credentials, Docker tokens, .env files, and git history (earlier coverage). Nextron.
· Jul 22 · observed · via package registry · Threat Activity - The DPRK "Rollup Polyfills" npm campaign expanded with new malicious packages
react-hot-svg v1.1.7 (stage 1) and rollup-plugin-polyfill-helper v1.0.0 (stage 2), abusing typosquatted CDN-style domains for C2 that is not yet active. Nextron Research.
· Jul 21 · attempted · via package registry · Supply Chain
July 22, 2026
- DPRK's "ClickFake Interview" campaign is impersonating recruiting platforms to drop the PylangGhost and GolangGhost RATs via spoofed platform and panel API endpoints. SOCRadar.
· Jul 22 · observed · via fake recruiter · Threat Activity
July 18, 2026
- DPRK "Contagious Interview" hides malware in SVG images — Elastic Security Labs details steganography and obfuscated JavaScript in trojanized coding repos to exfiltrate developer credentials (Elastic).
· Jul 18 · observed · via supply chain · Threat Activity