caption - Attack Overview

The attack flow of the current Contagious Interview campaign is divided into two paths. Depending on the target environment or the specific stage of the attack, the threat actors distribute either a combination of BeaverTail and InvisibleFerret, or deploy OtterCookie as a separate payload.

3.1. Beavertail, InvisibleFerret

3.1.1. task.json - Downloader

This downloader is executed only by VS Code. By setting the runOn property within runOptions to folderOpen, the injected command runs automatically whenever the repository’s folder is opened in VSCode.

hidden command in .vscode/task.json using long whitespace

A total of three separate commands were injected, designed to trigger the appropriate execution based on the victim's operating system (Linux, macOS, or Windows). The commands download a script from the C&C server and run it.

injected commands

Although the download URLs vary by operating system, the downloaded scripts for Linux and macOS are identical. All scripts follow a common pattern of downloading and executing an additional secondary script.

If the operating system is Linux or macOS, the shell script is initially downloaded to the path $HOME/Documents/tokenlinux.npl. After the download, the file is renamed to tokenlinux.sh and then executed.

Linux, macOS download script

If the operating system is Windows, a cmd script is downloaded to %USERPROFILE%/parse. The file is then renamed to token.cmd and executed.

Windows download script

However, during the analysis, the Windows cmd script could not be retrieved. The attempt resulted in an error message stating Access permanently suspended.

tokenlinux.sh - Downloader

The tokenlinux.sh file, executed on Linux and macOS, functions as a downloader and appears to have been authored by a Large Language Model (LLM).

In contrast to the scripts previously observed in the Contagious Interview campaign, this file features detailed commenting and the use of emojis within those comments, characteristics that strongly indicate it was generated using an LLM.

detailed comments using emojis

The tokenlinux.sh script first checks for the presence of a nodejs directory in the current path. If the directory is missing, it downloads and extracts the Node.js binary. After extraction, it adds Node.js to the system PATH. It then retrieves parser.js and package.json from the C2 server, saving them to the $HOME/Documents directory.

Finally, the script executes parser.js using the downloaded Node.js environment. The accompanying package.json file contains the dependency information required to run parser.js.

parser.js

parser.js is a JavaScript-based downloader that has been obfuscated using obfuscator.io. The key obfuscation techniques applied are as follows.

• String Extraction and Array Storage**:** Key strings used within the code are extracted and stored in a separate array.

• Runtime Array Shuffling**:** The order of the string array is rearranged by a specific logic at the beginning of execution.

• Offset-Based String Access**:** Strings are not referenced directly; instead, they are retrieved from the array using a separate wrapper function that accepts an offset value as an argument.

• Identifier Renaming**:** Meaningful variable and function names are replaced with short, meaningless identifiers such as a1.

obfuscated script

In addition to standard obfuscation, the script implements anti-tampering mechanisms. If the code detects any form of modification or ****formatting, it triggers the execution of dummy code designed to intentionally generate errors and halt the script's execution.

anti-tampering related function

The malware establishes communication with two distinct C&C servers, each serving a specific purpose as detailed below.

• Information Retrieval Server: Retrieves the configuration data required to download BeaverTail, specifically the address of the second C&C server and the Campaign ID.

• Malware Download Server: Downloads the actual BeaverTail payload.

The addresses for the information retrieval server are Base64 encoded, and two distinct addresses are provided. If communication with the primary C&C server fails, it automatically attempts to connect to the secondary server.

information retrieval server address decoding routine

Upon connecting to hxxp://[Information Retrieval Server]:1244/s/6df937fe9011, the malware checks if the response begins with the prefix ZT3. If confirmed, the subsequent data is Base64 decoded. The decoded string is structured as [C&C Address],[Campaign ID], separated by a comma. As of January 26, 2026, the C&C server address is identified as 66.235.175[.]117 and the campaign ID is knHbMe8.

malware download server address decoding routine

Strings within the code are decrypted using XOR with the key 0x70a07948.

string decryption routine

The malware download and execution process proceeds as follows.

1. Creates a .vscode folder in the Home directory.

2. Sends the Hostname, Username, and Current Time to hxxp://[Malware Download C2 Server]:1244/key

3. Downloads the BeaverTail script from hxxp://[Malware Download C2 Server]:1244/j/[Campaign ID]

   • Save Path: .vscode/test.js

4. Downloads the package file required to run test.js from hxxp://[Malware Download C2 Server]:1244/p

   • Save Path: .vscode/package.json

5. Executes .vscode/test.js.

The malware download routine is executed three times, repeating at approximately 10-minute intervals.

Beavertail

The BeaverTail malware consists of three distinct JavaScript files. The initially executed test.js downloads and executes the remaining two files. In addition, all Beavertail components empoly the same obfuscation and anti-tampering techniques previously observed in parser.js.

test.js

This script collects browser information then downloads and executes n.js and p.js. The list of browsers targeted for data collection is as follows.

• Chrome

• Chromium

• Brave

• Opera

The malware collects stored account credentials and browser extension data, then uploads them to hxxp://66.235.175[.]117:1244/uploads. The list of browser extensions targeted for this data collection is detailed in the table below.

After the data upload, the malware downloads a file from hxxp://66.235.175[.]117:1244/client/knHbMe8 and saves it as .npl. This downloaded file is InvisibleFerret, a Python-based payload, and is execute via Python. If the operating system is Windows, the malware downloads a Python interpreter from hxxp://66.235.11[.]117:1244/pdo to execute the .npl file.

.npl file download routine

Following the execution of InvisibleFerret, the remaining files of the BeaverTail malware are downloaded and executed. The file downloaded from hxxp://66.235.11[.]117:1244/n/knHbMe8 is saved as .vscode/n.js and the file downloaded from hxxp://66.235.11[.]117:1244/z/knHbMe8 is saved as .vscode/p.js.

additional Beavertail download routine

n.js

Functioning as a backdoor, this script first collects system information and uploads it to hxxp://66.235.175[.]117:1244/keys. The specific system information collected is as follows.

• location information retrieved from IP address

• ISP information

• uuid from HMAC digested username

• hostname

• username

• OS type

• OS release

• OS version

After the data upload, the malware establishes a socket connection to communicate with the C&C server. The C&C server is 216.250.251[.]87 and uses the port 1247.

socket connection routine

When the socket connection is established, the malware waits to receive a code value (command) from the C2 server. Based on this value, it executes malicious actions detailed in the table below.

When uploading files, the malware uses FTP. The specific domain, username, and password for the FTP server are transmitted from the C&C server. All files are uploaded to /DAknHbMe8/[hostname]+[username]/[filename].

FTP upload routine

The ssh_env command uploads all files at file paths that contain any of the strings listed in the table below.

However, files with specific names or extensions such as tsconfig.json are excluded from the upload. Similarly, specific directories such as node_modules are skipped during the search process. For the complete list of exclusions, refer to "Appendix C. Search Conditions".

p.js

This script is designed for file collection and upload. It searches and exfiltrates files located in paths that satisfy the patterns listed in the table below.

Similar to n.js, this component does not scan specific directory paths and does not upload files with specific extensions. For the detailed list of these exclusions, please refer to “Appendix C. Search Conditions”.

upload file search routine

File uploads are performed by sending a POST request with the structure described below to:
hxxp://66.235.175[.]117:1244/uploads.

{
    "timestamp": "jzt",
    "type": "knHbMe8",
    "hid": "[hostname]",
    "multi_file": {
        "value": "[files tream]", 
        "options" : {
            "filename": 
            "env_[current time]_[random number between 0~40]_[file index]"
        }
    }
}

{
    "timestamp": "jzt",
    "type": "knHbMe8",
    "hid": "[hostname]",
    "multi_file": {
        "value": "[files tream]", 
        "options" : {
            "filename": 
            "env_[current time]_[random number between 0~40]_[file index]"
        }
    }
}

{
    "timestamp": "jzt",
    "type": "knHbMe8",
    "hid": "[hostname]",
    "multi_file": {
        "value": "[files tream]", 
        "options" : {
            "filename": 
            "env_[current time]_[random number between 0~40]_[file index]"
        }
    }
}

In the structure above, the file index refers to the file's sequential position within the list generated by matching the search patterns.

Once the file upload is complete, the file path and hostname are uploaded to hxxp://66.235.175[.]117:1244/keys using the structure described below.

{
    "ts": "jzt",
    "type": "knHbMe8",
    "hid": "[hostname]",
    "ss": "jzt_[search pattern]_[current time]",
    "cc": "env_[current time]_[random number between 0~40]_[file index] : [file path]"
}

{
    "ts": "jzt",
    "type": "knHbMe8",
    "hid": "[hostname]",
    "ss": "jzt_[search pattern]_[current time]",
    "cc": "env_[current time]_[random number between 0~40]_[file index] : [file path]"
}

{
    "ts": "jzt",
    "type": "knHbMe8",
    "hid": "[hostname]",
    "ss": "jzt_[search pattern]_[current time]",
    "cc": "env_[current time]_[random number between 0~40]_[file index] : [file path]"
}

InvisibleFerret

InvisibleFerret is a Python-based malware that consists of five distinct Python scripts. All InvisibleFerret scripts are obfuscated using the method described below.

1. The string following the first 8 characters of the obfuscated text is decoded using Base85.

2. The decoded result is XORed with the first 8 characters which were previously unused. The resulting code is then executed using the exec function

3. The string executed via exec takes a new string, reverses it, Base64 decodes it, decompresses it using zlib, and then executes it again using exec.

4. Repeating the process in step 3 approximately 64 times results in the execution of the actual malicious script.

.npl

This InvisibleFerret script, executed by BeaverTail, downloads and runs two additional scripts.

script download and execution routine

Downloads a file from hxxp://66.235[.]175.117:1244/payl/knHbMe8, saves it as .vscode/pay, and executes it. Additionally, it downloads a file from hxxp://66.235[.]175.117:1244/bro/knHbMe8, saves it as .vscode/bow, and executes it. If the operating system is Darwin the bow file is not downloaded.

pay

This is a backdoor malware that performs malicious actions based on code values received through a socket connection with the C&C server. the C&C server address is 216.250.251[.]87 and uses the port 1245.

socket connection routine

The actions performed based on the received code values are detailed in the table below.

The ssh_env command searches and uploads files whose paths contain any of the strings listed in the table below.

For a detailed list of these parameters, refer to “Appendix C. Search Conditions”.

bow

The TsunamiInjector script is obfuscated and saved to the Startup folder to ensure the malicious script maintains persistence on the infected system.

script saving routine

The TsunamiInjector script decrypts and visits approximately 1,000 encrypted URLs to identify those that contain active content. The decryption process is as follows.

• Decodes the string encoded in hexadecimal.

• The decoded string is XORed with the key !!!HappyPenguin1950!!!.

• The decrypted string is Base64 decoded, and then the sequence of characters is reversed.

URL decryption routine

All decrypted URLs point to Pastebin, a popular text-sharing platform. If the script finds a Pastebin URL that still contains active content, it decrypts the text found on that page using the same process described previously. The result of the decryption is another URL; the file is downloaded from that URL and extracted to %APPDATA%\Microsoft\Windows\Applications\Runtime Broker.exe.

file download routine

Once the file download is complete, it excludes the file path from Windows Defender scans and creates a scheduled task to ensure it executes every time the user logs in.

task creation routine

adc

This script downloads AnyDesk, a remote desktop control program, from hxxp://66.235.175[.]117:1244/and. Afterward, it updates the downloaded AnyDesk’s configuration so that the attacker’s account can connect remotely at any time.

Anydesk configuration update routine

mc

This script manipulates the browser environment and ultimately installs a cryptocurrency wallet browser extension. Upon execution, it first self-deletes.

self-deletion routine

It then enumerates the extension directories of the Chrome and Brave browsers and deletes all files belonging to specific extensions. The list of target extension IDs is as follows.

• nkbihfbeogaeaoehlefnkodbefgpgknn

• acmacodkjbdgmoleebolmdjonilkdbch

After deleting the extension files, it downloads a file from hxxp://45.59.163[.]55:1244/mmz/[browser extension ID]_knHbMe8 and extracts it into the directory of the removed extension. The browser extensions modified in this process are Rabby Wallet and MetaMask, both of which are cryptocurrency wallet extensions.

browser extension file modification routine

Afterward, the malware collects Chrome’s profile settings files and sends them to hxxp://45.59.163[.]55:1244/h. If it receives a valid response from the server, it uses the response values to manipulate Chrome’s Secure Preferences settings.

Additionally, in macOS environments, if Chrome’s major version is 140 or higher, it attempts to downgrade Chrome by downloading a file from hxxp://45.59.163[.]55:1244/ddo and overwriting the app at /Applications/Google Chrome.app.

chrome downgrade routine

Once the settings changes are complete, it deletes all cookies, cache, session data, and other stored artifacts in the browser to apply the changes immediately, then sends the success status to hxxp://66.235.175[.]117:1244/t.

3.2. OtterCookie

task.json – Downloader

This downloader is executed only by VS Code. By setting the runOn property within runOptions to folderOpen, the injected command runs automatically whenever the repository’s folder is opened in VSCode. Unlike the task.json file used to distribute Beavertail and InvisibleFerret, the command is not hidden.

commands injected in .vscode/tasks.json

Although the download URLs vary by operating system, the downloaded scripts for Linux and macOS are identical. All scripts follow a common pattern of downloading and executing an additional secondary script.

If the operating system is Linux or macOS, the shell script is initially downloaded to the path $HOME/.vscode/vscode-bootstrap.sh and executed.

Linux, macOS download script

If the operating system is Windows, it downloads a CMD script to %USERPROFILE%\.vscode\vscode-bootstrap.cmd and executes it.

Windows download script

However, at the time of analysis, the CMD script downloaded on Windows printed the error message “Access permanently suspended.” and could not be obtained.

vscode-bootstrap.sh - Downloader

The vscode-bootstrap.sh script executed on Linux and macOS functions as a downloader. Like tokenlinux.sh, it appears to have been authored by an LLM. The difference is that it does not use emojis.

script with detailed comments

It checks whether a nodejs directory exists in the current path; if it does not, it downloads Node.js and extracts it. After extraction, it downloads env-setup.js and package.json from the C&C server and saves them to $HOME/.vscode. It then executes env-setup.js using the downloaded Node.js.

env-setup.js - Downloader

env-setup.js is a downloader that connects to hxxps://y-lilac-sigma.vercel[.]app/api/ipcheck-encrypted/608 and executes the response via eval function. Notably, it does not execute on a successful response; instead, it executes when an error occurs.

env-setup.js code

OtterCookie

OtterCookie is downloaded and executed via env-setup.js, and the same obfuscation and anti-tampering techniques as Beavertail are applied.

OtterCookie executes three scripts—stored as strings—in separate, independent processes. To prevent duplicate execution, it writes { pid: [process PID], startedAt: [process start time] } to a lock file. The lock file names and script details are shown in the table below.

ldbScript

This script collects account information stored in the browser and details about installed browser extensions. The list of target browsers for data collection is detailed in the table below.

The list of browser extensions targeted for data collection is detailed in the table below.

autoUploadScript

This script scans all drives for files containing specific strings and then uploads them to hxxp://172.86.73[.]198:8086/upload. For the strings used in the search, refer to “Appendix C: Search Conditions”.

file upload routine

Unlike ldbScript’s file upload method, no file metadata is included, and the file path is used to generate the HMAC token.

The autoUploadScript also appears to have been authored by an LLM, evidenced by traits such as unusually detailed comments and frequent console output that isn’t shown to the user.

socketScript

This script collects system information and sends it to hxxp://172.86.73[.]198:8087/api/notify. The collected fields and transmission format are as follows.

{
  ukey: 608,
  t: 6,
  host: "608_[hostname]",
  os: "[OS type]",
  username: "[username]",
  timestamp: "[current time]"
}

{
  ukey: 608,
  t: 6,
  host: "608_[hostname]",
  os: "[OS type]",
  username: "[username]",
  timestamp: "[current time]"
}

{
  ukey: 608,
  t: 6,
  host: "608_[hostname]",
  os: "[OS type]",
  username: "[username]",
  timestamp: "[current time]"
}

It then establishes a socket connection to the C&C server. The C&C server address is 172.86.73[.]198 and uses the port 8087. The actions performed based on messages received from the C&C server over the socket are shown in the table below.

The processControl command is designed to stop or restart ldbScript, autoUploadScript, and socketScript. But only the stop capability is actually implemented.

incompleted processControl command

The socketScript also appears to have been authored by an LLM, as suggested by traits like unusually detailed comments and frequent console output that isn’t shown to the user.