Key facts
- Organisation
- Regional transportation firm
- Threat
- Contagious Interview, a North Korea-aligned fake-recruitment campaign, delivering a credential stealer of the InvisibleFerret family
- Initial access
- A fake recruiter's coding test, executed by an employed developer on a primary workstation
- Impact
- Developer credentials compromised, including source-control access; an unauthorised commit pushed to a company repository under a spoofed author identity
- Core issue
- Untrusted code ran on a workstation with no endpoint detection, and the source-control login behind it had no second factor
What this case shows
- Threat actors actively focus on developers, reaching out through career platforms beyond the perimeter of corporate defenses.
- A single unauthenticated login enables attackers to insert code into production repositories under a legitimate colleague's identity.
- Forensic certainty depends entirely on log retention, as unrecorded telemetry leaves potential activity unverified.
When unreviewed code executes on an internal endpoint, a Compromise Assessment identifies residual traces, while Digital Forensics determines what data was extracted.
What this would have cost without Blackpanda IR-1 in place
| ODIR | IR-1 | |
|---|---|---|
| Type of engagement | On-demand incident response | Yearly subscription |
| Hours covered | 60 hours | Unlimited* |
| Pricing1 | USD $30,000 | USD $3,000 |
* Unlimited for one incident per year
1 Ad-hoc incident response pricing based on average market rates, from USD 500 per hour. Blackpanda IR-1 subscription pricing based on no. of endpoints, costing approx. 10x less than ad-hoc and retainer-based incident response. All figures are illustrative only, for guidance and marketing purposes and not to be relied upon by the reader. Actual incident response costs vary by scope, complexity, and provider.
CHALLENGE
Operating with a lean, in-house engineering team, a regional transportation company developed and deployed its own proprietary platform software. By placing full product access across a small number of employee laptops, the organization adopted a structure common to modern enterprises of similar scale, making its standard setup the central vulnerability.
In March 2026, a recruiter on a job platform sent one of the company's developers a standard coding assignment. The initial download showed no activity, but two months later, while continuing their job search, the developer launched a second test from the same contact. Within four minutes of loading the page, unauthorised code began running on the laptop. The script installed a loader in the home directory, secured persistence by modifying the login profile to auto-execute at startup, and actively extracted sensitive data from both the keychain and web browser.
Assuming that everything reachable from a host is compromised represents the only defensible position after a credential stealer operates unchecked within a browser. Blackpanda adopted this exact stance. The affected credentials comprised an SSH key alongside the developer's source-control login. Someone leveraged that login in May 2026 to push a commit to a corporate repository, masquerading under a spoofed author identity. Such an event illustrates a credential compromise unfolding entirely isolated from the perimeter.
The discovery occurred entirely by chance. While migrating the project to a new hosting provider, the front-end engineering team conducted a detailed review of the commit logs for the first time in months. During this audit, they spotted an anomalous commit graph that did not align with any team member's assignment history. By the time this discrepancy came to light, the malware had already resided undetected on the workstation for approximately three weeks.
SOLUTION
1. Establish what ran, and when
By imaging the workstation and constructing a precise filesystem timeline around execution, Blackpanda showed that the initial setup occurred almost instantaneously: writing the loader, altering the login profile, and establishing persistence. The loader subsequently loaded later stages directly into memory to minimise its disk footprint, a tactic that underscores why timeline analysis proves far more effective than a simple file scan.
Because shell history and cloned repositories were completely erased, the exact trigger for execution could not be verified. Rather than speculating, Blackpanda noted this gap directly and confirmed the retrieved loader as an InvisibleFerret credential stealer masquerading as a standard editor file.
2. Test the exfiltration question against evidence
Proving a data leak requires meeting three key conditions, all of which Blackpanda evaluated. Prior to the investigation, the malware had already met the first two criteria: it targeted specific data and possessed an active egress channel. However, it failed the third. Over a two-hour window, every outgoing request to the command server timed out and disconnected without establishing a connection. Furthermore, forensic analysis revealed no traces of compromised customer or personal information within the retrieved artifacts.
A single gap remained unaccounted for. Because endpoint and network logs were unmaintained for the initial day and a half post-infection, available evidence could neither confirm nor rule out data exfiltration during that period. Blackpanda explicitly identified this unresolvable window in its findings, choosing transparent reporting over unsupported conclusions.
3. Eliminate the false positive
Prioritising the firm's initial concerns, Blackpanda immediately inspected a substantial archive generated on the host shortly after the intrusion, which had initially been suspected of being staged for data exfiltration.
Analysis of its contents and metadata revealed a benign reality: the file was merely an internal repository backup containing routine test and development code, completely free of malicious tooling, external configurations, or links to the loader. Because it remained strictly local and unreferenced, ruling out this false positive was essential to prevent unnecessary remediation expenditure.
4. Draw the boundary
When evaluating an incident, board members focus on determining whether the scope of the compromise extended past the affected host. Through an investigation of the developer's source-control environment and cloud access, Blackpanda established that activity was strictly confined to that individual host and credential. Containment measures implemented by the client, specifically revoking access immediately upon identifying the anomalous commit, effectively prevented further lateral progression.
RESULTS
1. The intrusion was bounded
Blackpanda confirmed the compromise reached one workstation and one developer identity, with no evidence of spread into the wider environment.
2. The unauthorised commit was explained
The commit was attributed to the stolen source-control login rather than to any insider, and confirmed as the activity the client had originally detected.
3. A suspected staging archive was cleared
By confirming that the archive raised as a potential exfiltration vector was completely benign, Blackpanda resolved the concern and saved the client from pursuing unnecessary remediation efforts.
4. The gap in the record was named
Blackpanda openly acknowledged that the roughly day-and-a-half gap in telemetry creates an unverifiable timeframe where data exfiltration cannot be definitively confirmed or ruled out, opting not to frame the investigation as entirely closed.
5. The conditions that made the attack cheap were documented
Defensive gaps on the host made the intrusion effortless. The endpoint lacked detection software, multi-factor authentication was absent on the source-control platform, remote administration utilities operated under root privileges, and commits were signed using a personal email address, undermining attribution confidence.
The attack succeeded largely because basic precautions were omitted. Executing unverified repositories on an active development host, associating commits with unauthenticated personal accounts, and protecting source control with only a password allowed a state-sponsored threat group to achieve its objectives in four minutes. Preventative safeguards are straightforward and economical. Deploying isolated sandboxes for external code, requiring multi-factor authentication for version control, mandating signed commit reviews, and retaining logs sufficient for forensic analysis cost substantially less than responding to an incident.
FREQUENTLY ASKED QUESTIONS
1. Why would a state-linked group target our developers rather than our finance team?
Because developers hold what the group wants. MITRE ATT&CK catalogues this campaign as Contagious Interview, a North Korea-aligned group active since 2023, conducting both cyberespionage and financially motivated operations across Windows, Linux and macOS, with particular focus on people working in software development. A finance team can authorise a payment. Developers possess the ability to modify software deployed to your customer base, in addition to maintaining access to code repositories and cloud environments.
2. Our developer was the victim. Is this a security failure or a hiring one?
Neither perspective is entirely constructive. The developer was simply adhering to standard career practices by executing a recruiter's coding assessment, a routine expectation that the lure was precisely designed to manipulate. Consequently, the breakdown stems from systemic architectural vulnerabilities rather than individual fault, as the environment allowed unverified code execution on a workstation with access to production credentials.
3. The investigation could not rule out data loss. How should we read that?
Treat this as an honest assessment of the consequences of establishing a logging strategy without considering forensic requirements. While it is reassuring that all monitored connections failed and no personal details were identified in the available evidence for the logged timeframe, no technique can recover information that was never captured during the initial day and a half prior to logging.
4. We have multi-factor authentication on email. Would that have covered this?
Multi-factor authentication protects only the systems where it is implemented; in this instance, it was omitted from source control. Security controls typically prioritise perceived core assets like email inboxes over code repositories, leaving stolen source-control credentials fully functional. Blackpanda's past investigations include incidents where intrusions persisted undetected on client infrastructure for weeks before discovery.
5. How do we let developers run unfamiliar code without handing over the company?
Separate the machine from the privilege. Untrusted repositories should build and run in isolated, disposable environments, never on the workstation that holds source-control credentials and cloud sessions. Pair that with signed commits and branch protection, so that even a stolen login cannot introduce code without a review it has to pass.
6. What would an IR-1 subscription have changed here?
The primary advantages are rapid initial response and reduced overall expenditure. IR-1 maintains an incident response team on standby prior to any incident. This proactive stance proves critical during the crucial timeframe when an organisation evaluates whether an unexpected commit log warrants escalation. Having executed this identical protocol for an account takeover under an IR-1 activation, Blackpanda demonstrates that the key distinction lies in response speed rather than technical methodology.
WHAT THIS MEANS FOR YOUR ORGANISATION
The vector exploited in this campaign relies on a long-standing tactic: bypassing perimeter defenses by targeting individuals outside traditional protective boundaries, using devices typically classified as standard laptops rather than critical access keys. Every organisation with an in-house engineering team shares this vulnerability. Rather than questioning whether developers might succumb to deceptive recruitment lures, security leaders should evaluate what resources a compromised workstation can access.
Addressing two key areas significantly reduces this risk: transition untrusted code execution away from primary hosts into ephemeral, isolated environments; and conduct an audit of privileged accounts relying solely on single-factor authentication, prioritising version control repositories over email systems. Blackpanda's Incident Response Preparation services assist organisations at this proactive stage, enabling strategic security enhancements before an incident occurs.
ABOUT BLACKPANDA
Blackpanda is Asia's leading cyber incident response company, delivering digital emergency response across three integrated channels: IR consulting, IR-1 assurance subscriptions, and Lloyd's of London-underwritten cyber insurance. Each is purpose-built for a different buyer, whether enterprise, mass market, or sophisticated risk-transfer clients, and each stands alone as full incident response. Together, these channels reach the entire commercial market, because our mission is to provide digital emergency response for everyone. Buy all three and they combine into the complete post-attack recovery solution: preparation in advance, response the moment you're hit, and financial recovery paid for by insurance. One local team to help you get ready, respond, and recover.
