githash
docs
OtterCookie active
North Korea-linked stealer delivered through fake job coding tests.
A modular DPRK stealer spread through the Contagious Interview campaign: fake recruiters send trojanized coding assessments, with the payload split across files in the project's assets. It steals browser credentials, crypto wallets and files, and installs a remote-control trojan. Same umbrella campaign as PolinRider, but a separate toolchain.
references
spread over time
Press play to watch the threat spread, or drag the slider to pick dates.
Loading graph…
known-malicious hashes · 14
| sha-256 | file names | repos | files | first seen | last seen |
|---|---|---|---|---|---|
| 77be709d9338667f… | botbackup.js |
1 | 1 | ||
| b303429bdb3a6e6d… | webpack-rtl.config.js |
1 | 1 | ||
| 518f6352fcd3d1c4… | vite.config.ts |
1 | 1 | ||
| 7ed660585e9bb6a8… | next-env.d.ts |
3 | 3 | ||
| 05be971f172a59bc… | next-env.d.ts |
1 | 1 | ||
| 1e5e8d96dd6c679f… | eslint.config.mjs |
3 | 3 | ||
| ddf845d3078ca687… | next.config.ts |
1 | 1 | ||
| f0b4c4baaa441106… | next.config.mjs |
1 | 1 | ||
| 6748ad91b49c6216… | next-env.d.ts |
1 | 1 | ||
| ff0143f68f63ba80… | next.config.mjs |
1 | 1 | ||
| 4742476058378ccc… | next.config.mjs |
2 | 2 | ||
| 3e1659f5ffb08e71… | astro.config.mjs |
1 | 1 | ||
| 5fc6ae97da737b1b… | knip.config.ts |
1 | 1 | ||
| d12404d3786870cd… | next-env.d.ts |
1 | 1 |