Home › Threat Actors › Contagious Interview / Famous Chollima (North Korea)
← All Threat Actors
Nation-State high North Korea (DPRK)

Contagious Interview / Famous Chollima (North Korea)

North Korean state-aligned cluster; attributed to the Contagious Interview / Famous Chollima activity cluster by multiple researchers tracking the PolinRider campaign · Financial — credential theft and cryptocurrency/asset theft from developer workstations, consistent with Contagious Interview's documented financial collection mandate

Reports 1
Active Since PolinRider campaign active since at least March 2026 and ongoing as of this report
Last Reported 27 Jul 2026
Sectors Targeted finance, communications, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

  • Published 162 malicious release artifacts across 108 packages/extensions on npm, Packagist, Go modules, and the Chrome Web Store
  • Payloads concealed in configuration files or fake .woff2 font files within otherwise legitimate-looking packages
  • Obfuscated JavaScript loaders executed via VS Code auto-run tasks (.vscode/tasks.json) — technique merged in from the overlapping TaskJacker cluster (April 2026)
  • Blockchain-based C2: loader contacts public blockchain RPC nodes to retrieve an encrypted second-stage payload, decrypted and run in memory — resilient to server takedown since the endpoint derives from on-chain state
  • Final-stage malware: DEV#POPPER (information stealer with established Contagious Interview attribution) and OmniStealer (cross-platform credential harvester targeting browser sessions, crypto wallets, SSH keys, cloud tokens)
  • Account conditioning: obtained commit access to legitimate packages via genuine-looking pull requests from newly created accounts, built over weeks before inserting malicious code

Known Targets

Developers with cryptocurrency, LLM API key, or cloud credential accessAI and Web3 development ecosystemsFinance/DeFi application developersEnergy, manufacturing, and government contracting (via transitive dependency exposure)

Analyst Notes

Campaign remained active/expanding at time of reporting, with new malicious packages continuing to appear as attackers cycle through compromised maintainer accounts.

Also Known As

PolinRider (campaign name)Contagious InterviewFamous ChollimaTaskJacker (overlapping cluster)DEV#POPPER (associated malware)

MITRE ATT&CK Techniques

T1195.002 Supply Chain Compromise: Compromise Software Supply Chain T1204.002 User Execution: Malicious File T1555.003 Credentials from Password Stores: Credentials from Web Browsers T1552.004 Unsecured Credentials: Private Keys

Intelligence Reports

Briefing financecommunications

PolinRider: North Korea Floods npm, Go and Chrome With 108 Malicious Packages

A North Korean supply chain campaign tracked as PolinRider has distributed 162 malicious release artifacts across 108 packages in npm, Packagist, Go modules, and Chrome extensions, using VS Code auto-run tasks and blockchain-based command-and-control to deliver credential-stealing malware.

27 Jul 2026 · 4 min read