Contagious Interview 2.0: Disgusting screens, EtherHelling and the backdoor macOS that uses the block chain to hide your C2

A new turn in the campaign known as Contagious Interview, linked to actors with alleged ties to North Korea, shows how social engineering and blockchain technology are being combined to evade detections and pressure macOS victims to run malicious code. Instead of a phishing mail or a false interview, the victim reaches a page from a sponsored search result and, when opening it, finds a full screen simulating a system update or reboot. As the user panics and believes that the computer has failed, the site quietly copies a command to the clipboard and asks him to hit it in Terminal: a variation of the trick known as ClickFix.

The threat is not limited to fear. The downloaded command runs a backdoor on Node.js that persists through a LaunchAgent and, in an unusual way for previous campaigns of the same cluster, resolves its command and control server (C2) by consulting an intelligent contract in Ethereum. This method - called EtherHiding - allows to publish the direction of the C2 in the block chain, which makes it difficult to take down and assign because the content is replicated and resistant to central elimination. The implant checks the server every five minutes and can receive and run arbitrary JavaScript, in addition to deploying two additional loads: a stealer that collects credentials from browsers, SSH keys, AWS / Azure / npm and data from 157 cryptomoneda portfolios, and a malicious extension that is installed by patching the Secure Preferences file of Chrome to drain funds.

Beyond the new technique, the campaign reveals an operation with signs of industrialization: contracts deployed by disposable wallets, minimum funds to run them, configuration writing and subsequent abandonment, all replicated in an automatic pattern. This logistics suggests that the actor has optimized the deployment and operation process to increase resilience and scale. The specialists who have analysed the campaign also stress that, although North Korean groups have historically used baits related to job offers and interviews, the model of deception has been expanded to take advantage of legitimate searches and sponsored ads, raising the risk for users outside of technical or recruitment profiles.

The implications are multiple. On the individual plane, users of macOS who trust screens that mimic the operating system risk running commands that seem harmless but install back doors. For organizations, the ability of malware to steal cloud service credentials and development keys can be translated into side movements and prolonged exfiltration. And for the cryptoactive community, the combination of stolen information plus an extension capable of handling portfolios represents a direct threat to digital funds. The use of the block chain to hide C2 configurations also adds complexity to legal and operational responses because indicators can move or reappear with new directions.

What can a user or security officer do today to reduce the risk? First of all, never paste or run terminal commands from web pages, emerging dialogues or unverified sources. That simple rule stops most ClickFix techniques. Strengthen digital hygiene: active Gatekeeper and notarized macOS protections, keep the system and software up-to-date, and restrict accounts with administrator privileges for daily tasks. In corporate environments, implement policies that block the execution of unsigned binaries and control persistence through inventories of LaunchAgens and LaunchDaemons. For those using cryptoforeign exchange, the recommendation is to separate hot backgrounds from cold ones, adopt hardware portfolios and review installed browser extensions; if you detect extensions that you did not install, distrust and delete them.

From the technical point of view, it is advisable to audit the points where persistence and exfiltration can be introduced: check files in ~ / Library / LaunchAgens and / Library / LaunchAgens, examine changes in secure browser preferences and monitor outgoing connections to unusual domains or PIs. The transparency of the block chain, although used to hide C2, also offers a research channel: related addresses and transactions can be publicly inspected in explorers such as Etherscan, which helps to draw funding patterns and clusters used by the operator. In order to contextualize the discovery and its media dissemination, it is possible to see specialized coverage that summarizes these vectors and powers in security media such as The Hacker News.

Finally, if you suspect that it has been compromised, reduce the exposure window: disconnect the network equipment, change passwords from a clean device, check and revoke compromised keys or tokens, and consider a safe copy restoration or complete reinstallation if the intrusion is deep. Reporting commitment indicators to your security provider and working with incident response teams helps contain the spread. This incident recalls that the attack surface is not only technical, but also human: the combination of convincing social engineering and modern techniques such as EtherHering requires a defense approach that mixes awareness, technical controls and proactive detection.