Hackers lure developers into getting infected with cross-platform malware through fake interviews

‍‍

On 21 October 2024, conclusive evidence emerged that a North Korea-linked threat group is targeting job seekers in the tech industry, spreading the latest versions of two known malware families: BeaverTail and InvisibleFerret. In the "Contagious Interview" campaign first tracked in November 2023, these threat groups used job-seeking platforms to pose as prospective employers and establish contact with software developers. This situation has drawn widespread concern and brought new safety challenges to the tech industry.

▌Malware Online Interview Trap

Attackers often proactively invite victims to participate in online interviews, during which they use various methods to try to convince victims to download and install malware.

In the first stage of infection, the BeaverTail downloader and information stealer appear. This malware is carefully designed to target two common operating system platforms: Windows and Apple macOS. Its main function is to act as a delivery channel for the Python-based InvisibleFerret backdoor program, laying the groundwork for subsequent malicious actions.

There is ample evidence that even though the activity has been publicly disclosed and received a certain level of attention, it remains active. This situation clearly indicates that the threat group behind this operation continues to achieve ongoing success. They mainly achieve their covert purposes by inducing developers to execute malicious code under the pretext of programming tasks.

▌Contagious Interview Attack Chain and Analysis of New Malware Version

The attack chain penetrates developers' systems through fake Windows and macOS video conferencing software (disguised as well-known brands such as MiroTalk and FreeConference.com) and implants BeaverTail and InvisibleFerret malware.

In the "Contagious Interview" campaign, its overall modus operandi may continue to be used because of its ongoing effectiveness. Although this campaign has been widely reported and analysed in depth, social engineering techniques, such as posing as recruiters, remain highly deceptive, especially for those unfamiliar with such threats or who may overlook basic security measures during the job-seeking process. Attackers exploit trust and a sense of urgency in professional settings to successfully create a reliable method for gaining access to victims' devices.

The latest version of the malware is developed using the Qt framework, which supports cross-platform compilation for Windows and macOS. This means that the Qt-based BeaverTail version is even more powerful; it can not only steal browser passwords but also collect data from multiple cryptocurrency wallets.

▌Speculation on the Economic Motives of North Korean Malware

Another reason for the lack of variation in this campaign's tactics may lie in their release of a new version of the malware, namely BeaverTail, which is now written using the Qt framework. This malware is more stealthy, harder to detect, and supports both macOS and Windows platforms. This allows attackers to continue using previous attack methods, such as fake job interviews and disguised recruiters, to launch attacks on a wider range of victims and devices without making major adjustments to the campaign's mechanism.

BeaverTail's functionality is not limited to exfiltrating data to servers controlled by hostile forces; it can also download and execute a backdoor program called InvisibleFerret. This backdoor program contains two major components: the first is the core payload, which can fingerprint infected hosts, implement remote control, perform keylogging, exfiltrate data, and download AnyDesk software; the second is a browser stealer, specifically designed to collect browser credentials and credit card information.

According to relevant analyses, North Korea-backed threat groups may commit financial crimes with the goal of raising funds. Given that the BeaverTail malware has the ability to steal from 13 different cryptocurrency wallets, it can be speculated that the campaign may stem from economic motives.

▌Conclusion

In today's digital age, the threat of malware is increasingly severe. We have seen North Korea-linked threat groups use job-seeking platforms to spread malware through the "Contagious Interview" campaign plan, bringing huge security challenges to the tech industry. From the analysis of the attack chain to the anatomical study of malware functions, and then to the speculation about its economic motives, we deeply recognise the complexity and danger of malware. However, it is not only threat groups with this background that will use this method; organizations of any other background or form may use this effective social engineering method.

In the face of these threats, we need to be highly vigilant, strengthen security awareness, and not easily download and install software from unknown sources during the job-seeking process. At the same time, enterprises and institutions should also strengthen security protection measures to improve their ability to identify and prevent malware.

As a pioneer in domestic cybersecurity measurement and validation platforms, Security Validation is committed to using first-hand victim threat intelligence to empower organizations' existing security defense systems, achieving effective advance deployment of cybersecurity, and contributing to the protection of digital security.

‍

‍