Reported by 2 outlets

Timeline

1. original reporting

   Contagious Interview Operators Move Beyond Git Hooks With Trojanized Mac Applications

   gbhackers.com · 39d ago · September 4th, 2026

   North Korea-linked Contagious Interview operators have expanded their developer-targeting malware delivery operation beyond booby-trapped Git hooks and coding repositories, using trojanized macOS applications distributed as disk images and installer packages. Jamf Threat Labs identified 14 malicious DMG and PKG samples impersonating legitimate Mac software, all of which ultimately deliver an OtterCookie-aligned JavaScript implant designed for […] The post Contagious Interview Operators Move Beyond Git Hooks With Trojanized Mac Applications appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   DPRK-Linked Hackers Use Trojanized macOS Installers to Deploy OtterCookie RAT

   cyberpress.org · 39d ago · September 4th, 2026

   DPRK-linked threat actors are using fake macOS installers to deliver the OtterCookie remote access trojan (RAT) in an expansion of the long-running Contagious Interview campaign. Jamf Threat Labs found 14 malicious DMG and PKG files impersonating popular Mac applications, including The Unarchiver, Presentify, PDFify, Magic Disk Cleaner, Sketch, SiteSucker Pro, Mole, Bartender, Disk Doctor Pro, and Mp3tag. The campaign is linked to earlier attacks that used fake job-interview assignments, malicious Git hooks, and Visual Studio Code task files. The attackers target people who may download and run software as part of a coding test, job application, or developer-related task. Instead of relying only on infected project repositories, the operators are now disguising their malware as legitimate macOS applications. DPRK Trojanizes macOS Installers The malicious DMG files contain an altered version of a real-looking application. Inside the application bundle, attackers add a hidden executable named .macos . They also modify the app’s Info.plist configuration so macOS launches the hidden file when the victim opens the application. The hidden program first removes the quarantine attribute from the legitimate-looking app and launches it as a decoy. This lets victims see the expected application while malicious activity runs in the background. DPRK Trojanizes macOS Installers (Source: jamf) The malware then contacts a staging server at 162.0.239[.]85 over port 3000 and downloads a script