GitLab’s security team identified and disrupted 131 accounts controlled by North Korean state actors running the “Contagious Interview” campaign, which tricks developers into executing malicious code during fake technical interviews.
The actors used base64-encoded staging URLs in .env files, custom error handlers abusing Function.constructor for remote code execution, and legitimate services like Vercel to host payloads.
Beyond the malware distribution, GitLab uncovered a structured IT worker cell that generated $1.64 million since 2022, while a single operator ran at least 21 fraudulent personas, because one fake identity is never enough.
The report builds on GitLab’s September 2025 tech note on a BeaverTail variant that the same actors compiled into executables and pushed through a ClickFix lure at marketing and trading roles instead of developers.
Silobreaker’s Hannah Baumgaertner told CSO that the core methods have stayed broadly similar, with more AI, more ClickFix and Visual Studio Code now frequently used for initial access.
