Atlassian researchers have identified and helped disrupt a North Korea-linked campaign exploiting fake technical interviews on trusted development platforms to deliver malware that compromises credentials, wallets, and corporate systems.
- Fraudulent coding tests on major dev platforms conceal malware.
- North Korean threat actors employ realistic front companies.
- Victims can unknowingly propagate the malicious repositories.
What happened
Atlassian uncovered a concerted cyber espionage campaign dubbed Contagious Interview that targets software developers via fake recruitment processes. The attackers use Bitbucket, GitHub, and GitLab repositories that appear as fully functional coding challenges but hide malicious payloads within minimal suspicious code snippets. When candidates run these assessments, the malware steals credentials, crypto wallets, API tokens, and system access.
The attackers create convincing front companies with detailed websites and recruiter identities to make their outreach credible. Atlassian collaborated with industry partners to identify hundreds of such repositories and accounts and successfully took them down, simultaneously enhancing detection methods and simplifying user abuse reporting.
Why it matters
This campaign highlights the risks developers face when trusting widely used software development platforms for technical assessments. The use of plausible coding projects helps criminals evade suspicion and infiltrate organizations through personnel, potentially gaining access to sensitive data and infrastructure.
Moreover, the involvement of North Korea-linked actors with advanced operational techniques and shared tradecraft across multiple campaigns illustrates a coordinated threat landscape. Additionally, some victims unwittingly become distributors by uploading infected repositories themselves, spreading the malware further within the community.
What to watch next
Organizations and developers should remain vigilant for suspicious recruitment approaches involving code assessments and leverage updated detection tools and platform reporting capabilities. Security teams should monitor Indicators of Compromise associated with Contagious Interview and related North Korean campaigns to reduce risk.
Atlassian and other platform providers will continue enhancing their defenses and collaborating on threat intelligence sharing to counter evolving malware delivery methods and front company tactics. Following published best practices and community alerts will be key in mitigating damage from this and similar campaigns.