Contagious Interview / AccuraSoftHire npm Poisoning: OTX Pulse Detection Pack for Developer-Targeted DPRK-Style Intrusion

---
title: Suspicious npm Lifecycle Script Spawns Shell or Downloader
id: 9f1b7b10-5b8c-4a0c-9a3c-0c2f7d5a1a01
status: experimental
description: Detects node/npm lifecycle execution that spawns shells, downloaders, or script interpreters consistent with poisoned take-home interview packages.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.exe'
      - '\npm.cmd'
      - '\npx.cmd'
      - '\pnpm.exe'
      - '\yarn.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate build tooling
  - Developer automation
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
  - attack.t1609
date: 2026/11/11
---
title: AccuraSoftHire Fake Interview Infrastructure Connection
id: 7c8a2f61-52c5-4c0a-8d5e-8ab4f6f10b22
status: experimental
description: Detects network or DNS access to AccuraSoftHire fake interview staging infrastructure and path patterns from OTX pulse.
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'accurasofthire.com'
  selection_ip:
    DestinationIp:
      - '103.179.142.155'
  selection_path:
    Image|endswith:
      - '\node.exe'
      - '\npm.exe'
      - '\npm.cmd'
      - '\powershell.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: (selection_domain or selection_ip) and selection_path
falsepositives:
  - Threat research
  - Sanctioned red team validation
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1102
date: 2026/11/11
---
title: Browser Credential and Crypto Wallet Access After Node Execution
id: 4c8e0e2e-8ba1-4d5d-a7f5-6cf2aa1d93aa
status: experimental
description: Detects node/npm-launched processes accessing browser credential stores, wallet files, SSH keys, cloud tokens, npmrc, or git credential files.
author: Security Arsenal
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\node.exe'
      - '\npm.exe'
      - '\npm.cmd'
      - '\powershell.exe'
      - '\cmd.exe'
  selection_target:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
      - '\.ssh\'
      - '\.aws\credentials'
      - '\.azure\'
      - '\.config\gcloud\'
      - '\.npmrc'
      - '\.git-credentials'
      - '\Login Data'
      - '\Cookies'
      - '\Local State'
      - '\wallet.dat'
      - '\Exodus\'
      - '\Electrum\'
      - '\MetaMask\'
  condition: selection_process and selection_target
falsepositives:
  - Developer credential helper tools
  - Browser sync utilities
level: high
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1552
  - attack.collection
  - attack.t1005
date: 2026/11/11

let lookback = 14d;
let badDomain = "accurasofthire.com";
let badIp = "103.179.142.155";
let pathRx = @"(camera-driver/(ack|setup-(win|mac|linux))|notification-settings-win\?download=1)";
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated >= ago(lookback)
| where RemoteUrl has badDomain or RemoteIP == badIp or RemoteUrl matches regex pathRx
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType),
(DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where ProcessCommandLine has_any (badDomain, badIp, "camera-driver", "notification-settings-win")
   or (InitiatingProcessFileName in~ ("node.exe","npm.exe","npm.cmd","npx.cmd","pnpm.exe","yarn.exe")
       and FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","curl.exe","wget.exe","mshta.exe","wscript.exe","cscript.exe","bitsadmin.exe","certutil.exe"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath),
(DeviceFileEvents
| where TimeGenerated >= ago(lookback)
| where InitiatingProcessFileName in~ ("node.exe","npm.exe","npm.cmd","powershell.exe","cmd.exe")
| where FolderPath has_any (@"\AppData\Local\Google\Chrome\User Data\", @"\AppData\Local\Microsoft\Edge\User Data\", @"\.ssh\", @"\.aws\", @"\.azure\", @"\.config\gcloud\", @"\.npmrc", @"\.git-credentials", "MetaMask", "Exodus", "Electrum", "wallet.dat", "Login Data", "Local State")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, ActionType)
| sort by TimeGenerated desc

$ErrorActionPreference = 'SilentlyContinue'
$Lookback = (Get-Date).AddDays(-14)
$Indicators = @('accurasofthire.com','103.179.142.155','camera-driver','notification-settings-win')
Write-Host '[*] Checking network connections for AccuraSoftHire indicators...'
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq '103.179.142.155' } | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess
foreach ($p in Get-Process node,npm,powershell,cmd,curl,wget,chrome,msedge,firefox -ErrorAction SilentlyContinue) {
  try {
    $cmd = (Get-CimInstance Win32_Process -Filter "ProcessId=$($p.Id)").CommandLine
    if ($cmd -and ($Indicators | Where-Object { $cmd -like "*$_*" })) {
      Write-Host "[!] Suspicious process: PID=$($p.Id) Name=$($p.ProcessName) Cmd=$cmd"
    }
  } catch {}
}
Write-Host '[*] Reviewing recent DNS cache for domain hits...'
Get-DnsClientCache | Where-Object { $_.Entry -like '*accurasofthire.com*' -or $_.Data -eq '103.179.142.155' } | Select-Object Entry,RecordName,RecordType,Status,Data
Write-Host '[*] Checking developer credential stores touched recently...'
$paths = @(
 "$env:LOCALAPPDATA\Google\Chrome\User Data",
 "$env:LOCALAPPDATA\Microsoft\Edge\User Data",
 "$env:APPDATA\Mozilla\Firefox\Profiles",
 "$env:USERPROFILE\.ssh",
 "$env:USERPROFILE\.aws\credentials",
 "$env:USERPROFILE\.npmrc",
 "$env:USERPROFILE\.git-credentials"
)
foreach ($path in $paths) {
  if (Test-Path $path) {
    Get-ChildItem $path -Recurse -Force -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -ge $Lookback -or $_.LastAccessTime -ge $Lookback } | Select-Object FullName,LastWriteTime,LastAccessTime,Length
  }
}
Write-Host '[*] Checking persistence locations...'
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' | Select-Object PSPath,PSChildName,Property
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'node|npm|powershell|cmd|curl|wget' -and $_.TaskPath -notlike '\Microsoft*' } | Select-Object TaskName,TaskPath,State,Actions
Write-Host '[*] Searching recent package folders for suspicious lifecycle scripts...'
Get-ChildItem "$env:USERPROFILE\Downloads","$env:USERPROFILE\Desktop","$env:USERPROFILE\source","$env:USERPROFILE\repos" -Recurse -Filter package.json -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -ge $Lookback } | ForEach-Object {
  $j = Get-Content $_.FullName -Raw | ConvertFrom-Json
  $scripts = @($j.scripts.PSObject.Properties.Value) -join ' ; '
  if ($scripts -match 'curl|wget|powershell|certutil|bitsadmin|Invoke-WebRequest|postinstall|preinstall|node -e') {
    Write-Host "[!] Suspicious package.json: $($_.FullName) Scripts=$scripts"
  }
}