Researchers Trace Fake-Interview Campaign Using Malicious VS Code Tasks to Deliver InvisibleFerret
Summary
OpenSourceMalware describes a campaign targeting developers with fake coding assessments and malicious VS Code tasks. Its analysis of 14 repositories found 11 payload variants, including loaders that deliver the InvisibleFerret backdoor.
Key points
- The researchers attribute the campaign to North Korean actors associated with Lazarus and say it targets software developers through fake recruiter approaches and coding assessments.
- Malicious repositories use `.vscode/tasks.json` to run a JavaScript file disguised as a `.woff2` font when a VS Code workspace is opened and trusted.
- The analysis of 14 repositories found 11 payload variants; the researchers report identifying 17 repositories using the technique.
- The first-stage BeaverTail loader contacts the C2 domain `eth-mainnet-alchemy[.]com` and can execute JavaScript returned by the server.
- The researchers describe a subsequent InvisibleFerret loader and Python backdoor with reported capabilities including credential and wallet theft, keylogging, clipboard hijacking, and persistence.
- The article recommends reviewing `tasks.json` before trusting unfamiliar workspaces, verifying recruiters through official channels, and monitoring for suspicious processes and network connections.
Article Details
- Attack Vectors
- Fake recruiters contact software developers through LinkedIn and direct them to malicious GitHub repositories framed as coding assessments.
- A malicious .vscode/tasks.json configuration runs a JavaScript payload disguised as a .woff2 font when the victim opens and trusts the workspace in VS Code.
- The BeaverTail loader contacts a typosquatted C2 domain and executes JavaScript returned by the server; a later stage downloads and runs the InvisibleFerret Python backdoor.
- Defensive Notes
- Review .vscode/tasks.json and other project automation files before trusting or opening unfamiliar repositories.
- Disable or restrict VS Code task auto-execution for untrusted projects.
- Verify recruiters through official company channels and review code before trusting a workspace.
- Monitor developer workstations for suspicious processes and network connections, and apply the article's provided detection rules and IOCs.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | eth-mainnet-alchemy[.]com | Typosquatted C2 domain contacted by BeaverTail to retrieve the next-stage JavaScript payload. |
| URL | hxxp[:]//eth-mainnet-alchemy[.]com/api/service/token/f71d1d9b2de7d4ebf5f706a4b9cd4eb4 | Specific C2 endpoint used by BeaverTail to request code from the attacker-controlled server. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationBeaverTail and InvisibleFerret use layered Base91 encoding, obfuscated strings, and dynamically constructed code.T1053.003 · CronOn Linux, InvisibleFerret adds a crontab entry to run the backdoor at reboot.T1056.001 · KeyloggingThe backdoor installs a keyboard listener to record keystrokes.T1059.006 · PythonThe final backdoor is a Python payload downloaded and executed by the loader.T1059.007 · JavaScriptVS Code tasks run the disguised JavaScript font file through Node.js.T1082 · System Information DiscoveryInvisibleFerret detects the operating system, architecture, and Node.js version and gathers system information.T1105 · Ingress Tool TransferThe loader retrieves a second-stage JavaScript payload and the Python backdoor from C2.T1115 · Clipboard DataThe malware monitors and replaces cryptocurrency addresses in the clipboard.T1204.002 · Malicious FileThe attack depends on the victim opening and trusting the malicious project in VS Code.T1518.001 · Security Software DiscoveryThe loader checks the host for security tools, including antivirus, EDR, and monitoring software.T1543.001 · Launch AgentOn macOS, InvisibleFerret creates a LaunchAgent for persistence.T1547.001 · Registry Run Keys / Startup FolderOn Windows, InvisibleFerret establishes persistence through a startup registry entry.T1555.003 · Credentials from Web BrowsersThe backdoor extracts saved browser passwords and cookies from browsers including Chrome, Firefox, Edge, and Brave.T1555.005 · Password ManagersInvisibleFerret searches browser wallet extensions and extracts cryptocurrency private keys.T1566.003 · Spearphishing via ServiceFake recruiters use LinkedIn messages to direct developers to malicious coding-assessment repositories.
People
Threat Actors
Malware
Vendors
Products
GitHubThe analysis above is awesome, but the reality is that's just one GitHub repository in this campaign. What about the others? What's the scope of the "Fake Font" campaign?LinkedInTargets developers via fake LinkedIn recruitersNode.jssend you a GitHub link. The repository looks legitimate—a web application project with a React frontend, Node.js backend, proper README, even a CI/CD configuration. Everything you'd expect from a professionalVS Codeteam has identified a new variation of the "Contagious Interview" campaign that uses malicious Microsoft VS Code tasks files to spread the associated malware. This campaign started over 100 days ago, but has ramped up
Industries
Cryptocurrencya multi-stage loader that ultimately deploys the InvisibleFerret Python backdoor, designed to steal cryptocurrency wallets, browser credentials, and establish persistent access. This is the third sub campaign of thefintechIt starts with a message on LinkedIn. A recruiter from what appears to be a legitimate cryptocurrency or fintech company reaches out with an exciting opportunity. They're impressed by your GitHub profile and want to see