North Korean cyber operators linked to the Contagious Interview campaign, also tracked as WaterPlum, are leveraging Microsoft Visual Studio Code (VS Code) projects to distribute a malware family known as StoatWaffle. This new tactic exploits VS Code’s “tasks.json” auto-run functionality, enabling malware to execute automatically when a developer opens any file in a compromised project folder.
How StoatWaffle Operates
The malware chain begins by checking if Node.js is installed on the victim system. If it is missing, StoatWaffle downloads and installs Node.js before launching a downloader. This downloader periodically contacts an external server to fetch additional payloads, which execute as Node.js scripts.
StoatWaffle has two main modules:
- Stealer Module – Extracts credentials and extension data from Chromium-based browsers and Mozilla Firefox. On macOS, it also targets the iCloud Keychain. Stolen data is sent to a command-and-control (C2) server.
- Remote Access Trojan (RAT) – Provides attackers full control over the infected system, including file enumeration, execution of Node.js code, shell commands, and uploading targeted files.
Japanese cybersecurity researchers note that WaterPlum continues to enhance StoatWaffle, reflecting a broader trend of increasingly sophisticated malware in the open-source ecosystem.
Wider Campaigns and Targeting
North Korean actors have also deployed other malware families, including:
- BeaverTail – Distributed via malicious JavaScript in public GitHub repositories.
- PylangGhost (FlexibleFerret/WeaselStore) – Propagated via npm packages, capable of Go and Python-based modular attacks.
- OtterCookie and InvisibleFerret – Backdoors designed for extensive data theft, often used in multi-stage attacks.
Microsoft reported that these threat actors often gain initial access through carefully staged recruitment processes, including fake technical interviews. Targets are typically high-level professionals—CTOs, founders, and senior engineers in cryptocurrency or Web3 sectors—who have privileged access to corporate systems and wallets. LinkedIn is frequently used for these social engineering campaigns.
Recent iterations of the malware have moved from Vercel-hosted scripts to GitHub Gist-hosted payloads, increasing the difficulty of detection and further automating malware deployment.
Mitigation Measures
In response, Microsoft introduced the task.allowAutomaticTasks setting in VS Code version 1.109 (January 2026), which defaults to “off” to prevent automatic execution of tasks from malicious projects. This measure cannot be overridden at the workspace level, preventing infected repositories from bypassing global security settings. The subsequent 1.110 release adds a secondary prompt to alert users of auto-run tasks.
Global Implications
The campaign coincides with broader North Korean cyber operations targeting cryptocurrency professionals and IT infrastructure worldwide. The U.S. Department of Justice recently sentenced three individuals involved in a North Korean IT worker scheme designed to generate illicit revenue through cyber operations, highlighting the ongoing threat posed by state-sponsored cybercrime.
Experts warn that embedding malware into trusted developer tools and assessment workflows exploits users’ trust during high-pressure situations, making it particularly effective against highly skilled professionals.
