· Threat Intelligence
On the Hunt
Latest · Threat Intelligence
DPRK's Contagious Interview Meets ErrTraffic
DPRK's Contagious Interview campaign appears to have started buying ClickFix traffic from ErrTraffic, a kit sold as a service, alongside its fake recruiter and fake interview lures. Every route delivers a portable Node.js loader that resolves its C2 from Polygon smart contracts labelled team1 to team10, plus a second npm.zip RAT kit with a hardcoded C2.
Read the analysis →
Recent posts
All posts →
Latest hunts
Hunt Repo →- hunt-2025-044 · T1528 · Entra ID FOCI Cross-Resource Token Pivot — Non-Interactive Sign-In Burst
- hunt-2025-045 · T1528 · Entra ID Device Code Auth Followed by FOCI Multi-Resource Burst
- hunt-2025-041 · T1566.002 · Microsoft Defender XDR Workers.dev Phishing URL in Email — Device Code Campaign Detection