Contagious Interview Expands to Trojanized macOS Installers: DPRK OtterCookie Campaign — OTX Pulse Analysis & Detection Pack

---
title: Unsigned macOS Application Execution from Mounted DMG
id: 7c3f1a2e-9d41-4b8a-a6f2-ottercookie001
status: experimental
description: Detects execution of unsigned or ad-hoc signed binaries from DMG-mounted volumes or quarantined downloads, consistent with Contagious Interview trojanized installers (OtterCookie)
author: Security Arsenal Threat Intelligence
date: 2026/10/04
references:
    - https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/
logsource:
    category: process_creation
    product: macos
detection:
    selection_path:
        Image|startswith:
            - '/Volumes/'
            - '/private/var/folders/'
    selection_tmp:
        Image|contains:
            - '/Library/Caches/'
            - 'AppTranslocation'
    condition: selection_path or selection_tmp
falsepositives:
    - Legitimate unsigned open-source tools run from disk images
level: medium
tags:
    - attack.execution
    - attack.t1204.002
---
title: LaunchAgent Persistence Created by User-Installed Application
id: 8d4a2b3f-1e52-5c9b-b7a3-ottercookie002
status: experimental
description: Detects creation of LaunchAgent/LaunchDaemon plist files by non-Apple processes, a persistence mechanism used by OtterCookie in the Contagious Interview campaign
author: Security Arsenal Threat Intelligence
date: 2026/10/04
references:
    - https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/
logsource:
    category: file_event
    product: macos
detection:
    selection:
        TargetFilename|contains:
            - '/Library/LaunchAgents/'
            - '/Library/LaunchDaemons/'
        TargetFilename|endswith: '.plist'
    filter_apple:
        SourceImage|startswith:
            - '/System/'
            - '/usr/libexec/'
    condition: selection and not filter_apple
falsepositives:
    - Legitimate software updaters installing helper agents
level: high
tags:
    - attack.persistence
    - attack.t1543.001
    - attack.t1543.004
---
title: OtterCookie C2 Communication to Known Malicious Infrastructure
id: 9e5b3c4a-2f63-6d1c-c8b4-ottercookie003
status: experimental
description: Detects DNS resolution or network connection to pobelstudio.com, identified C2/distribution infrastructure for the DPRK Contagious Interview OtterCookie campaign
author: Security Arsenal Threat Intelligence
date: 2026/10/04
references:
    - https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/
logsource:
    category: dns
detection:
    selection:
        query|contains: 'pobelstudio.com'
    condition: selection
falsepositives:
    - Threat research and sandbox detonation
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001

// Hunt: OtterCookie / Contagious Interview activity — C2 beacons, trojanized installer hashes, and macOS persistence
let OtterCookieHashes = dynamic([
    "01955691147a036e2104a16f9c3b34d11cb3304e184ed9d533325705599b876b",
    "08425172a2dc19516ba9a3fcca8a0a789962d9b95d1792974f69c086ee64aec9",
    "0882bb158878a1ca19320f5160dc93f4608c862f3ab652671bb92a82b2f1eb39",
    "0d306f347999e02cbbe41d6ff1c47aecbc994213b3cc65bbf4aa723469e6e5ab",
    "0e12f41c2d3d2e48b5a004bff4c126bf8e907bc6c20648f3844ed4ebad126a29",
    "1abbdeee6d03894c0c53240f7ba873fadf9367e312ada1d280420bc88f986e91",
    "24a252e72d767d62f3076f4f59780511288ea9eedd0e30f234c9cdd5b7644cbf"
]);
let C2Domain = "pobelstudio.com";
let NetHits = DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has C2Domain
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
let DnsHits = DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has C2Domain
    | summarize ConnectionCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, RemoteIP;
let HashHits = DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where SHA256 in~ (OtterCookieHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, AccountName;
let PersistenceHits = DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where FolderPath has_any ("LaunchAgents", "LaunchDaemons") and FileName endswith ".plist"
    | where InitiatingProcessFolderPath !startswith "/System/"
    | project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, SHA256;
union NetHits, HashHits, PersistenceHits
| sort by TimeGenerated desc

#!/bin/bash
# Security Arsenal — OtterCookie / Contagious Interview macOS IOC Hunt
# Run via MDM (Jamf/Intune) or manually with sudo on macOS endpoints

echo "=== OtterCookie IOC Hunt: $(hostname) — $(date) ==="

KNOWN_HASHES=(
"01955691147a036e2104a16f9c3b34d11cb3304e184ed9d533325705599b876b"
"08425172a2dc19516ba9a3fcca8a0a789962d9b95d1792974f69c086ee64aec9"
"0882bb158878a1ca19320f5160dc93f4608c862f3ab652671bb92a82b2f1eb39"
"0d306f347999e02cbbe41d6ff1c47aecbc994213b3cc65bbf4aa723469e6e5ab"
"0e12f41c2d3d2e48b5a004bff4c126bf8e907bc6c20648f3844ed4ebad126a29"
"1abbdeee6d03894c0c53240f7ba873fadf9367e312ada1d280420bc88f986e91"
"24a252e72d767d62f3076f4f59780511288ea9eedd0e30f234c9cdd5b7644cbf"
)

echo "[1/5] Scanning /Applications and ~/Downloads for known malicious hashes..."
for dir in /Applications ~/Downloads /tmp; do
  [ -d "$dir" ] || continue
  find "$dir" -type f \( -name "*.dmg" -o -name "*.pkg" -o -perm +111 \) 2>/dev/null | while read -r f; do
    h=$(shasum -a 256 "$f" 2>/dev/null | awk '{print $1}')
    for kh in "${KNOWN_HASHES[@]}"; do
      [ "$h" == "$kh" ] && echo "  [ALERT] Malicious hash match: $f"
    done
  done
done

echo "[2/5] Checking for unsigned copies of impersonated applications..."
for app in "The Unarchiver" "Sketch" "Bartender"; do
  app_path=$(mdfind "kMDItemCFBundleIdentifier == '*'" 2>/dev/null | grep -i "$app.app" | head -1)
  if [ -n "$app_path" ]; then
    if ! codesign -v "$app_path" 2>/dev/null; then
      echo "  [ALERT] Unsigned/modified app: $app_path"
    fi
    spctl -a -vv "$app_path" 2>&1 | grep -qi "rejected" && echo "  [ALERT] Notarization rejected: $app_path"
  fi
done

echo "[3/5] Auditing LaunchAgents/LaunchDaemons for suspicious persistence..."
for plist_dir in /Library/LaunchAgents /Library/LaunchDaemons ~/Library/LaunchAgents; do
  [ -d "$plist_dir" ] || continue
  find "$plist_dir" -name "*.plist" -mtime -30 2>/dev/null | while read -r p; do
    label=$(/usr/libexec/PlistBuddy -c "Print :Label" "$p" 2>/dev/null)
    prog=$(/usr/libexec/PlistBuddy -c "Print :ProgramArguments:0" "$p" 2>/dev/null)
    case "$prog" in /System/*|/usr/libexec/*) continue;; esac
    echo "  [REVIEW] Recent persistence: $p | Label=$label | Exec=$prog"
  done
done

echo "[4/5] Checking DNS cache and active connections for pobelstudio.com..."
lsof -i -n -P 2>/dev/null | grep -i "pobelstudio" && echo "  [ALERT] Active C2 connection detected"
log show --predicate 'process == "mDNSResponder"' --last 24h --style compact 2>/dev/null | grep -i "pobelstudio.com" && echo "  [ALERT] C2 domain in DNS query log"

echo "[5/5] Checking for App Translocation artifacts and hidden executables in app bundles..."
ls -d /private/var/folders/*/*/*/AppTranslocation/* 2>/dev/null | head -20
find /Applications -type f -perm +111 -not -path "*/Contents/MacOS/*" 2>/dev/null | head -20 | while read -r h; do
  echo "  [REVIEW] Hidden executable in bundle: $h"
done

echo "=== Hunt complete. Escalate any [ALERT] findings to IR immediately. ==="