#ParsedReport #CompletenessMedium
03-09-2026

Contagious Interview steps outside the developer workflow

https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/

Report completeness: Medium

Actors/Campaigns:
Contagious_interview

Threats:
Ottercookie

Victims:
Mac users, Software developers, Cryptocurrency wallet users

Geo:
Dprk

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1036, T1059.004, T1059.007, T1071.001, T1083, T1105, T1115, T1204.002, T1546.016, T1553.001, have more...

IOCs:
File: 28
IP: 2
Url: 9
Domain: 5
Hash: 28

Soft:
macOS, Node.js, Visual Studio Code, Gatekeeper, curl, sudo, Telegram

Algorithms:
zip, sha256

Functions:
func, is_vmware_mac

Languages:
javascript

Platforms:
amd64, apple, arm, intel

Links:
https://github.com/W3PI-Protocol/w3pi-contracts