Socket Contagious Interview NPM April 2025

Contagious Interview has used hexadecimal string encoding to hide critical JavaScript module names, function names, and C2 URLs, which are decoded dynamically at runtime.

HexEval Loader has encoded module names and C2 URLs as hexadecimal strings in attempts to evade analysis.

HexEval Loader has masqueraded and typosquatted as legitimate code repository packages and projects.

HexEval Loader has exfiltrated victim data using HTTPS POST requests to its C2 servers.

Contagious Interview has exfiltrated data from a compromised host to actor-controlled C2 servers.

HexEval Loader has executed malicious JavaScript code.

HexEval Loader has used HTTP and HTTPS POST requests to communicate with C2.

HexEval Loader has been used to download a malicious payload to include BeaverTail.

HexEval Loader has decoded its payload prior to execution.

Contagious Interview has relied on users to install a malicious library from a code repository to infect the victim's device and has led to additional payload distribution and theft of sensitive data.

Contagious Interview has used TCP port 1224 for C2.

Contagious Interview has registered domains to leverage in their social engineering campaigns. Contagious Interview has also registered domains to utilize for C2.

Contagious Interview has used web services such as Dropbox to receive stolen data and Google Drive, Firebase, GitHub, and Telegram to disseminate files. Contagious Interview has also used a cloud platform such as Vercel for C2 operations leveraging malicious web applications and static pages. Contagious Interview has also used Slack to coordinate their activities.

Contagious Interview has created and maintained personas on code repositories to distribute malicious payloads.

Contagious Interview developed malicious NPM packages for delivery to or retrieval by victims.

Contagious Interview has hosted malicious payloads on code repositories used as lures for victims to download.