Contagious Interview: DPRK Campaign Hits 30,000 Devices, Steals $10.71M in Crypto — Detection and Defense Guide

---
title: Suspicious Child Process Spawned by Package Manager (Contagious Interview Pattern)
id: 8c1e4a92-3f47-4b2d-9c65-a7d2e1f08b3c
status: experimental
description: Detects Node.js/npm or Python spawning shells, download cradles, or script interpreters consistent with trojanized coding-assessment packages used in the Contagious Interview campaign.
references:
  - https://thehackernews.com/2026/09/contagious-interview-campaign.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\python.exe'
      - '\pythonw.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate build tooling and developer automation scripts
level: high
---
title: Non-Browser Process Accessing Cryptocurrency Wallet Extension Data
id: 2f7b9d31-6a14-4e58-b903-1c8e5d72f6a4
status: experimental
description: Detects processes other than the browser reading crypto wallet extension storage directories, consistent with credential and wallet theft staged by Contagious Interview payloads.
references:
  - https://thehackernews.com/2026/09/contagious-interview-campaign.html
  - https://attack.mitre.org/techniques/T1555/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1539
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn'
      - '\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa'
      - '\AppData\Roaming\Exodus\'
      - '\AppData\Roaming\Electrum\wallets\'
      - '\.config\google-chrome\Default\Local Extension Settings\'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
  condition: selection_paths and not filter_browsers
falsepositives:
  - Backup software and enterprise DLP agents scanning user profiles
level: high
---
title: Download Cradle via Node or Python One-Liner
id: 5d3a8c16-9b02-4f71-ae48-2d6c9b41e7f0
status: experimental
description: Detects inline download-and-execute patterns using node -e or python -c with HTTP requests, a common staging technique for second-stage payloads in fake interview malware.
references:
  - https://thehackernews.com/2026/09/contagious-interview-campaign.html
  - https://attack.mitre.org/techniques/T1059.007/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059.006
  - attack.t1059.007
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_node:
    Image|endswith: '\node.exe'
    CommandLine|contains:
      - '-e "'
      - '--eval'
  selection_py:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
    CommandLine|contains: '-c "'
  selection_net:
    CommandLine|contains:
      - 'https.get'
      - 'fetch('
      - 'requests.get'
      - 'urllib.request'
      - 'Invoke-WebRequest'
      - 'DownloadString'
  condition: (selection_node or selection_py) and selection_net
falsepositives:
  - Developer quick-testing of API calls from the command line
level: medium

// Contagious Interview hunt: trojanized interview packages + wallet/credential theft
// Lookback: 14 days
let lookback = 14d;
let suspiciousParents = dynamic(["node.exe","npm.cmd","npm","python.exe","pythonw.exe","python3"]);
let suspiciousChildren = dynamic(["powershell.exe","pwsh.exe","cmd.exe","curl.exe","wget","certutil.exe","bitsadmin.exe","wscript.exe","cscript.exe","bash","sh"]);
let walletPaths = dynamic([
    "nkbihfbeogaeaoehlefnkodbefgpgknn",   // MetaMask (Chrome)
    "bfnaelmomeimhlpmgjnjophhpkkoljpa",   // Phantom (Chrome)
    "Exodus", "Electrum", "Login Data", "Cookies", "Web Data"
]);
let proc =
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ (suspiciousParents)
  and FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, SHA256, ReportId;
let fileHits =
DeviceFileEvents
| where TimeGenerated > ago(lookback)
| where FolderPath has_any (walletPaths)
| where not(FileName in~ ("chrome.exe","msedge.exe","brave.exe","firefox.exe"))
| project TimeGenerated, DeviceName, InitiatingProcessAccountName,
          FileName, FolderPath, InitiatingProcessFileName,
          InitiatingProcessCommandLine, SHA256;
proc
| union kind=outer fileHits
| sort by TimeGenerated desc

-- Contagious Interview hunt: interpreter processes with active network connections
-- and recently created archives/scripts in user download/temp locations
SELECT Pid, Ppid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE (Name =~ '(?i)node|python|npm'
   AND CommandLine =~ '(?i)eval|-e |-c |http|fetch|requests')
   OR CommandLine =~ '(?i)Invoke-WebRequest|DownloadString|curl |wget '

-- Correlate with established outbound connections from interpreters
SELECT Pid, Name, Path, Status, Family, Type,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Name =~ '(?i)node|python'
  AND Status = 'ESTABLISHED'
  AND RemoteIP !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

-- Recently staged archives and scripts in user-writable locations (last 7 days)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
  'C:/Users/*/Downloads/*.zip',
  'C:/Users/*/Downloads/*.tar.gz',
  'C:/Users/*/Downloads/*.tgz',
  'C:/Users/*/Downloads/**/package.json',
  'C:/Users/*/AppData/Local/Temp/**/*.js'
])
WHERE Mtime > now() - (7 * 24 * 3600)
ORDER BY Mtime DESC

# Contagious Interview workstation audit - run elevated where possible
$report = @()

# 1. Find recently cloned repos / archives with npm install scripts (install hooks = execution gate)
$searchRoots = @("$env:USERPROFILE\Downloads", "$env:USERPROFILE\source", "$env:USERPROFILE\Documents")
foreach ($root in $searchRoots) {
  if (Test-Path $root) {
    Get-ChildItem -Path $root -Recurse -Filter package.json -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
      ForEach-Object {
        $pkg = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue | ConvertFrom-Json -ErrorAction SilentlyContinue
        if ($pkg.scripts -and ($pkg.scripts.preinstall -or $pkg.scripts.postinstall -or $pkg.scripts.install)) {
          $report += [pscustomobject]@{
            Finding = "package.json with install hook (execution on npm install)"
            Path    = $_.FullName
            Detail  = ($pkg.scripts | Out-String).Trim()
            LastWrite = $_.LastWriteTime
          }
        }
      }
  }
}

# 2. Flag unsigned or temp-path node/python binaries running (active staging)
Get-Process node,python,pythonw -ErrorAction SilentlyContinue | ForEach-Object {
  $sig = Get-AuthenticodeSignature $_.Path -ErrorAction SilentlyContinue
  if ($sig.Status -ne 'Valid' -or $_.Path -match 'Temp|Downloads') {
    $report += [pscustomobject]@{
      Finding = "Unsigned/unexpected interpreter process running"
      Path    = $_.Path
      Detail  = "PID $($_.Id), Signature: $($sig.Status)"
      LastWrite = $null
    }
  }
}

# 3. Check for recently modified crypto wallet / browser credential stores
$walletPaths = @(
  "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn",
  "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data",
  "$env:APPDATA\Exodus",
  "$env:APPDATA\Electrum\wallets"
)
foreach ($p in $walletPaths) {
  if (Test-Path $p) {
    $item = Get-Item $p -ErrorAction SilentlyContinue
    $report += [pscustomobject]@{
      Finding = "Wallet/credential store present (verify no unauthorized access)"
      Path    = $p
      Detail  = "LastWrite: $($item.LastWriteTime)"
      LastWrite = $item.LastWriteTime
    }
  }
}

$report | Format-List
# $report | Export-Csv -Path .\contagious_interview_audit.csv -NoTypeInformation