SecuriTricks

Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery

The Contagious Interview campaign, linked to North Korean actors, has evolved to use JSON storage services for hosting and delivering malware. This campaign targets software developers, particularly those in cryptocurrency and Web3 projects, across Windows, Linux, and macOS. The attackers use socia…

rat

social engineering

Published: November 14, 2025

Downloadable IOCs: 84

Uncovering a Web3 Interview Scam

A Ukrainian Web3 team's interview process involved cloning a GitHub repository containing malicious components. Analysis revealed the project replaced a legitimate dependency with a malicious NPM package, rtk-logger@1.11.5. This package collected sensitive data, including cryptocurrency wallet info…

Published: August 13, 2025

Downloadable IOCs: 0

macOS NimDoor | North Korean Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

DPRK threat actors are targeting Web3 and crypto-related businesses using Nim-compiled binaries and multiple attack chains. The malware, dubbed NimDoor, employs unusual techniques for macOS, including process injection and encrypted WebSocket communications. It uses a novel persistence mechanism le…

Published: July 4, 2025

Downloadable IOCs: 9

Tag: web3

Attack reports

Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery

Uncovering a Web3 Interview Scam

macOS NimDoor | North Korean Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

Inside the BlueNoroff Web3 macOS Intrusion Analysis

Unmasking GrassCall Campaign: The Hackers Behind Job Recruitment Cyber Scams

Meeten Malware: A Cross-Platform Threat to Crypto Wallets on macOS and Windows

ClickFix tactic: The Phantom Meet