Contagious Interview (UNC4736)

On attribution: This North Korea-linked campaign is tracked under several overlapping names by different vendors; attributions are those of the cited firms (Unit 42, Mandiant).

Overview

"Contagious Interview" is a North Korea-linked social-engineering campaign in which operators pose as prospective employers, recruiters, or former contractors to lure software developers and crypto-industry workers into downloading and running malware during fake interviews or "coding tests." It is tracked under names including UNC4736, AppleJeus, Citrine Sleet, Gleaming Pisces, and (as the related fraudulent job-seeker side) Wagemole. Unit 42 attributes it with moderate-to-high confidence to a DPRK state-sponsored actor; Unit 42 says the campaign dates back to at least December 2022. ^[1]

Tactics and malware

Operators approach targets via LinkedIn, job boards, Telegram, freelance marketplaces, or open-source communities, then send a "coding assignment," npm package, or video-call app that installs malware. Associated families include the BeaverTail downloader/infostealer, the InvisibleFerret Python backdoor, OtterCookie, and the macOS backdoor INLETDRIFT. Operators have also stood up fake "front companies" to add legitimacy. ^[1]

Impact

Mandiant attributed the October 2024 Radiant Capital theft (~$50 million) to UNC4736, which used a Telegram message impersonating a former contractor to plant malware on developers' machines and ultimately forge multisig approvals. The same fake-recruiter pattern underpins numerous targeted thefts, insider-access cases, and the parallel DPRK "IT worker" infiltration problem. ^[1][2]

Bracketed numbers refer to the numbered sources listed below.