GCVE-110-OSM-2026-670

This repository is part of the North Korean DPRK "contagious interview" malware campaign that seeks to steal crypto assets and credentials. There are several stages to the malware: When the git repo is cloned and the victim opens the source code in Microsoft Visual Studio, a vscode task downloads and installs the Beavertail JavaScript cryptostealer. This cryptostealer looks for any crypto assets, wallet files, env files and extiltrates them to an IP address 146.70[.]41[.]188. Next, bash scripts install a binary that enables persistence and C2.