{
	"id": "8d883a9d-d00e-439f-b15c-4a2f5266e441",
	"created_at": "2026-09-25T02:02:28.576699Z",
	"updated_at": "2026-09-25T02:05:16.98559Z",
	"deleted_at": null,
	"sha1_hash": "0e50e43f6c856715972c1ab2f7ee9cf165e39994",
	"title": "From fake interviews to malicious repositories: Disrupting Contagious Interview",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 2418123,
	"plain_text": "https://www.atlassian.com/blog/how-we-build/disrupting-contagious-interview\n\nFrom fake interviews to malicious repositories: Disrupting\n\nContagious Interview\n\nBy Ramazan Uysal, Parthiban Rajendran, Dawid Osojca, Atlassian Trust and Security\n\nPublished: 2026-09-21 · Archived: 2026-09-25 02:00:51 UTC\n\nSoftware developers and IT professionals are increasingly being targeted through fraudulent recruitment processes\n\nthat exploit their trust in established development platforms. Candidates are invited to complete seemingly\n\nlegitimate coding assessments hosted in publicly accessible repositories on services such as Bitbucket, GitHub,\n\nand GitLab. The repositories appear to be fully developed applications, with thousands of lines of plausible-\n\nlooking code and malicious payloads concealed in only a few lines.\n\nContagious Interview is a persistent campaign using this tactic, attributed with high confidence to North Korean\n\nthreat actors. When executed, the malicious payloads can steal credentials, cryptocurrency wallets, API tokens,\n\nand access to corporate systems.\n\nAtlassian has been working alongside industry peers and the broader security community to track and disrupt\n\nactivity associated with Contagious Interview. This blog post is being published alongside the full research report,\n\nwhich covers the campaign’s tradecraft, indicators of compromise (IOCs), and security best practices to help\n\nindividuals and organizations strengthen their defenses.\n\nNo action is required from Bitbucket customers. Protecting the platform from malicious activity remains an\n\nongoing priority for Atlassian.\n\nPage 1 of 5\n\nhttps://www.atlassian.com/blog/how-we-build/disrupting-contagious-interview\n\nActions Atlassian is taking\n\nAtlassian detects and responds to attempts to abuse its platforms. Our Acceptable Use Policy prohibits malicious\n\ncontent, and we take action when it is violated. To date, hundreds of Contagious Interview repositories and\n\nassociated accounts have been taken down. Detection continues to improve through industry collaboration and\n\nthreat intelligence. In-product reporting has also been simplified, allowing visitors to report malware and abuse\n\ndirectly through the Bitbucket interface while viewing a repository.\n\nPublishing this research supports broader threat intelligence exchange and helps maximize disruption efforts\n\nacross the industry.\n\nNotable patterns observed across malicious repositories\n\nAtlassian’s analysis identified recurring patterns across the campaign, including reused repository themes and\n\ncode structures, convincing front companies and recruiter personas, infrastructure overlaps with other North\n\nKorea-attributed activity, and evolving payload execution techniques.\n\nThe research also found that some victims unintentionally became distributors by uploading copies of malicious\n\nrepositories from legitimate accounts. The full report examines these findings in detail.\n\nRepository themes\n\nMalicious repositories repeatedly used similar naming conventions and recurring project themes. Many also\n\ncontained the same or nearly identical applications, code, and file structures, with only a small number of files\n\ndiffering—often the files concealing the malicious code.\n\nFront companies and fake recruiters\n\nPage 2 of 5\n\nhttps://www.atlassian.com/blog/how-we-build/disrupting-contagious-interview\n\nThreat actors established realistic-looking front companies, complete with custom domains, company websites,\n\nand seemingly well-established LinkedIn profiles, to make fraudulent recruitment outreach appear credible.\n\nRecruiter accounts used both common email providers and addresses tied to newly registered domains, further\n\nreinforcing the appearance of legitimacy.\n\nInfrastructure overlaps across different threat actors and campaigns\n\nAnalysis of IP addresses used to create malicious Bitbucket accounts and repositories found matches with IOCs\n\npublicly shared by external security researchers and organizations. Most matches related to BeaverTail and\n\nContagious Interview, as expected, while dozens were linked to other North Korea-attributed campaigns. These\n\noverlaps suggest that some North Korea-attributed groups share operational tradecraft across campaigns.\n\nEvolution of payload execution techniques\n\nThe analysis focused on how the initial loader (BeaverTail) concealed in these repositories was executed. Once the\n\nloader ran on a victim’s device, later-stage malware was delivered outside Bitbucket. The actors continually\n\nchanged and combined ways of triggering the loader, with almost half of the repositories using two or more\n\ntechniques. The quarter-by-quarter analysis shows techniques being added, changed, and retired over time.\n\nPage 3 of 5\n\nhttps://www.atlassian.com/blog/how-we-build/disrupting-contagious-interview\n\nVictims as unintended distributors\n\nThreat actors have started asking candidates to record themselves walking through coding assessments and upload\n\ntheir copies to GitHub or Bitbucket. Infected victims can therefore become part of the distribution chain, creating\n\nnew copies of malicious repositories from legitimate accounts.\n\nSecurity best practices\n\nWhile no action is required from Bitbucket customers, the guidance below can help individuals and organizations\n\nreduce risk and respond if they encounter a malicious coding assessment.\n\nbest practices\n\nBefore opening or running an unfamiliar repository\n\nUse a dedicated, isolated environment for coding assessments and take-home tests.\n\nDo not use a corporate workstation with access to production credentials.\n\nDisable Visual Studio Code automatic tasks by setting  task.allowAutomaticTasks  to  off .\n\nFor individuals who may be affected\n\nDisconnect the device from the network and notify the organization’s security team. Preserve the repository\n\nURL, recruiter messages, and commands that were run.\n\nFrom a known-clean device, revoke active sessions and rotate passwords, source-control tokens, SSH keys,\n\ncloud credentials, API keys, and other accessible secrets.\n\nPage 4 of 5\n\nhttps://www.atlassian.com/blog/how-we-build/disrupting-contagious-interview\n\nIf cryptocurrency keys or seed phrases may have been exposed, transfer assets to a new wallet created on a\n\nclean device.\n\nReformat or reimage the affected device. Deleting the repository or running an antivirus scan alone may\n\nnot remove follow-on malware or persistence.\n\nReport the repository and recruiter account to the relevant hosting and recruitment platforms.\n\nFor organizations\n\nMonitor for integrated development environments (IDEs) or terminal applications spawning unexpected\n\nshells and scripting runtimes, particularly when commands reference  .vscode , hidden directories,\n\ntemporary files, or downloaded dependency scripts.\n\nAlert on scripting processes accessing browser profiles, password stores, cryptocurrency wallets,\n\nkeychains,  .ssh , cloud configuration, environment files, or shell history—especially when followed by\n\nHTTP uploads or WebSocket connections.\n\nWhen compromise is suspected, isolate and reimage the endpoint, revoke exposed sessions and credentials,\n\ninvestigate downstream access, and hunt across the environment.\n\nFor additional security best practices, review Atlassian’s guidance on keeping your organization secure.\n\nIf you are seeking a deeper technical analysis, please download the full research report, which provides additional\n\ndetail on the campaign’s infrastructure and evolving tradecraft, along with a complete list of IOCs to support\n\ndetection and response efforts.\n\nSource: https://www.atlassian.com/blog/how-we-build/disrupting-contagious-interview\n\nPage 5 of 5",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.atlassian.com/blog/how-we-build/disrupting-contagious-interview"
	],
	"report_names": [
		"disrupting-contagious-interview"
	],
	"threat_actors": [],
	"ts_created_at": 1790301748,
	"ts_updated_at": 1790301916,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/0e50e43f6c856715972c1ab2f7ee9cf165e39994.pdf",
		"text": "https://archive.orkl.eu/0e50e43f6c856715972c1ab2f7ee9cf165e39994.txt",
		"img": "https://archive.orkl.eu/0e50e43f6c856715972c1ab2f7ee9cf165e39994.jpg"
	}
}