DPRK's Contagious Interview Meets ErrTraffic
DPRK's Contagious Interview campaign appears to have started buying ClickFix traffic from ErrTraffic, a kit sold as a service, alongside its fake recruiter and fake interview lures. Every route delivers a portable Node.js loader that resolves its C2 from Polygon smart contracts labelled team1 to team10, plus a second npm.zip RAT kit with a hardcoded C2.
Threat Intelligence Malware Analysis dprk lazarus contagious-interview