HOW TO GET SCAMMED (BY DPRK HACKERS)

Summary from the TLDR InfoSec newsletter

A security researcher documented a DPRK-linked Contagious Interview campaign in which threat actors posed as recruiters on Discord, delivering malware via fake technical assessments that deployed a multi-stage payload using blockchain-based dead-drop resolvers across Tron, Aptos, and Binance Smart Chain. The final RAT establishes persistence by injecting into VS Code and Cursor IDEs, exfiltrates credentials, and evades analysis by detecting cloud/CI/CD environments. Detection requires monitoring for Node.js processes that spawn with eval flags and API calls to blockchain endpoints such as api.trongrid.io.