Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025

Contagious Interview has exfiltrated data from a compromised host to actor-controlled C2 servers.

InvisibleFerret is written in Python and has used Python scripts for execution.

BeaverTail has executed malicious JavaScript code. BeaverTail has also been compiled with the Qt framework to execute in both Windows and macOS.

InvisibleFerret has collected OS type, hostname and system version through the "pay" module. InvisibleFerret has also queried the victim device using Python scripts to obtain the User and Hostname.

InvisibleFerret has queried the victim device using Python scripts to obtain the User and Hostname.

Contagious Interview has leveraged Astrill VPN for C2.

BeaverTail has been hosted on code repositories and disseminated to victims through NPM packages.

Contagious Interview has lured victims to click on a malicious link that led to download of a malicious payload. Contagious Interview has also leveraged links to malicious payloads on social media and code repositories.

BeaverTail has searched the victim device for browser extensions including those commonly associated with cryptocurrency wallets.

Contagious Interview has used fake job advertisements and messages sent via social media to spearphish targets. Contagious Interview has also leveraged hiring websites to solicit victims.

Contagious Interview has used services such as Astrill VPN.

Contagious Interview has registered domains to leverage in their social engineering campaigns. Contagious Interview has also registered domains to utilize for C2.

Contagious Interview has acquired virtual private servers from services such as Stark Industries Solutions and RouterHosting. Contagious Interview has also utilized hosting providers to include Tier[.]Net, Majestic Hosting, Leaseweb Singapore, and Kaopu Cloud.

Contagious Interview has used web services such as Dropbox to receive stolen data and Google Drive, Firebase, GitHub, and Telegram to disseminate files. Contagious Interview has also used a cloud platform such as Vercel for C2 operations leveraging malicious web applications and static pages. Contagious Interview has also used Slack to coordinate their activities.

Contagious Interview has created fake social media accounts such as LinkedIn and Telegram accounts for their targeting efforts.

Contagious Interview has created fake email accounts to correspond with social media accounts, fake LinkedIn personas, code repository accounts, and job announcements on development job board services. Contagious Interview has also utilized fake email accounts with Threat Intelligence vendor services.

Contagious Interview has appeared to have used AI to generate images and content to facilitate their campaigns.

Contagious Interview has hosted malicious payloads on code repositories used as lures for victims to download.

BeaverTail has searched the victim device for browser extensions commonly associated with cryptocurrency wallets.