A sophisticated threat campaign is actively targeting the software development and cryptocurrency ecosystems through a multi-pronged approach. Analysis of recent OTX pulses reveals a coordinated operation that combines supply-chain compromises, social engineering, and cloud infrastructure attacks to achieve its objectives.

The primary attack vector involves compromising legitimate software distribution channels. Threat actors have successfully compromised Ethersphere's release pipeline, publishing a malicious @ethersphere/bee-js npm package and trojanized Swarm Desktop releases. These artifacts contain loaders that fetch and execute JavaScript from a C2 domain, api.frameworkmetrics.xyz, granting the attackers full Node.js privileges on the victim's machine.

A parallel campaign, dubbed "Contagious Interview," uses fake job interviews to lure software developers. A fraudulent company, "AccuraSoftHire," posts job openings on legitimate platforms like Indeed and Glassdoor. Candidates are given take-home coding assignments that include malicious npm packages, leading to infection.

The campaign also demonstrates a capability to abuse cloud infrastructure. In one instance, an actor exploited IAM credentials from Qubole's AWS account to assume integration roles in customer environments, conducting extensive reconnaissance and data exfiltration.

The ultimate objective of this campaign appears to be financial gain through cryptocurrency theft. The use of an Ethereum smart contract as a C2 dead drop in the SleepyDuck backdoor strongly suggests an interest in compromising cryptocurrency wallets and exchanges.

Threat Actor / Malware Profile

SleepyDuck / EtherDuck

• Distribution Method: Supply-chain compromise of the @ethersphere/bee-js npm package and Swarm Desktop releases.
• Payload Behavior: The malicious package contains a loader that fetches and executes a JavaScript payload from a C2 server. The payload is a backdoor with capabilities for remote code execution, data exfiltration, and cryptocurrency theft.
• C2 Communication: The C2 infrastructure is notable for its use of the Ethereum blockchain as a dead drop. The malware communicates with a smart contract to retrieve C2 server addresses, making the infrastructure resilient to takedowns.
• Persistence Mechanism: The malware establishes persistence by creating scheduled tasks or cron jobs that periodically execute the loader.
• Anti-Analysis Techniques: The use of a JavaScript-based payload allows the malware to run in memory and avoid writing to disk, making it more difficult to detect with traditional antivirus solutions. The use of a blockchain for C2 communication also hinders analysis and tracking.

Contagious Interview

• Distribution Method: Social engineering through fake job interviews. Malicious npm packages are disguised as take-home coding assignments.
• Payload Behavior: The malicious npm packages are designed to steal cryptocurrency wallets, credentials, and other sensitive information from the victim's machine.
• C2 Communication: The malware communicates with a C2 server at accurasofthire.com to exfiltrate stolen data.
• Persistence Mechanism: The malware may create persistence mechanisms to maintain access to the victim's machine.
• Anti-Analysis Techniques: The use of a legitimate-looking job application process helps to lower the victim's guard and makes the attack more difficult to detect.

IOC Analysis

The OTX pulses provide a wealth of indicators that can be used to detect and respond to this campaign. The indicators include:

• IPv4 Addresses: 178.16.54.222, 185.232.84.169, 193.57.9.155, 45.83.220.211, 57.129.54.120, 185.209.199.73, 89.37.63.175, 103.179.142.155
• Domains: frameworkmetrics.xyz, api.frameworkmetrics.xyz, accurasofthire.com
• URLs: Multiple URLs associated with accurasofthire.com, including download links for the malicious coding assignments.
• File Hashes: A variety of MD5, SHA1, and SHA256 hashes for the malicious npm packages and other malware artifacts.

SOC teams should immediately operationalize these indicators by adding them to blocklists and threat intelligence platforms. These indicators can be used to create detection rules in firewalls, proxies, and EDR solutions. Tools like yara can be used to scan for the malicious file hashes on endpoints, while suricata or zeek can be used to detect network connections to the malicious IP addresses and domains.

Detection Engineering

---
title: SleepyDuck Loader Execution
id: 10000000-0000-0000-0000-000000000001
status: experimental
description: Detects the execution of the SleepyDuck loader, which fetches JavaScript from a C2 server.
author: Security Arsenal
date: 2026/11/10
references:
    - https://socket.dev/blog/bee-js-compromise
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'api.frameworkmetrics.xyz'
    condition: selection
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - Legitimate use of the api.frameworkmetrics.xyz domain
level: high
---
title: Contagious Interview Malicious URL Access
id: 10000000-0000-0000-0000-000000000002
status: experimental
description: Detects access to a malicious URL associated with the Contagious Interview campaign.
author: Security Arsenal
date: 2026/11/10
references:
    - https://research.jfrog.com/post/accurasofthire-fake-interview/
logsource:
    category: webserver
    product: zeek
detection:
    selection:
        url|contains: 'accurasofthire.com/camera-driver'
    condition: selection
fields:
    - url
    - src_ip
falsepositives:
    - Security research
level: high
---
title: Qubole Cross-Account Access
id: 10000000-0000-0000-0000-000000000003
status: experimental
description: Detects the use of Qubole's AWS credentials to assume roles in customer accounts.
author: Security Arsenal
date: 2026/11/10
references:
    - https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'sts.amazonaws.com'
        eventName: 'AssumeRole'
        userIdentity.principalId: '805246085872'
    condition: selection
fields:
    - eventName
    - userIdentity.principalId
    - recipientAccountId
falsepositives:
    - Legitimate use of Qubole's integration roles
level: medium

DeviceProcessEvents
| where ProcessCommandLine contains "api.frameworkmetrics.xyz" or ProcessCommandLine contains "accurasofthire.com"
| project DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName

# Hunt for network connections to known malicious IPs and domains
$maliciousIps = @("178.16.54.222", "185.232.84.169", "193.57.9.155", "45.83.220.211", "57.129.54.120", "185.209.199.73", "89.37.63.175", "103.179.142.155")
$maliciousDomains = @("frameworkmetrics.xyz", "api.frameworkmetrics.xyz", "accurasofthire.com")

Get-NetTCPConnection | Where-Object {$maliciousIps -contains $_.RemoteAddress} | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess

# Hunt for DNS queries to malicious domains
Get-DnsClientCache | Where-Object {$maliciousDomains -contains $_.Name} | Select-Object Name, Type, Data

Response Priorities

Immediate:

• Block all known malicious IPs, domains, and URLs at the firewall, proxy, and DNS level.
• Hunt for the execution of the SleepyDuck loader and access to Contagious Interview URLs on all endpoints.
• Scan all endpoints for the malicious file hashes.

24h:

• If a compromise is detected, isolate the affected endpoint and begin forensic analysis.
• Reset all credentials that may have been compromised, including developer credentials, AWS credentials, and cryptocurrency wallet keys.
• Notify affected users of the potential compromise and advise them to be vigilant for phishing attacks.

1 week:

• Review and harden the security of your software development lifecycle, including the vetting of third-party libraries and the security of your CI/CD pipeline.
• Implement strong IAM policies and multi-factor authentication for all cloud resources.
• Conduct security awareness training for all employees, with a focus on social engineering and phishing attacks.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub