GCVE-110-OSM-2026-9489

DPRK Contagious Interview campaign: repository contains two distinct malicious payloads — a base64-encoded C2 URL embedded in an API route file, and a hidden VS Code task that auto-executes an obfuscated JavaScript loader when the folder is opened. === PAYLOAD 1: Config File C2 Campaign === Malicious payload found in: server/routes/api/profile.js Base64 encoded: aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9VMk9QMA== Decoded C2 URL: https://www.jsonkeeper.com/b/U2OP0 Behavior: Base64-encoded C2 URL decoded at runtime via Buffer.from(...).toString("utf8") inside an Express API route. === PAYLOAD 2: VS Code Tasks Campaign === Malicious payload found in: .vscode/tasks.json Attack vector: Hidden task (label eslint-check, runOn: folderOpen, presentation.reveal: never, hide: true) that runs `node .vscode/cancel` Second-stage file: .vscode/cancel contains heavily obfuscated JavaScript (jsjiami-style string-array/self-defending obfuscation) Behavior: Downloads/executes RAT loader payload automatically when VS Code opens the project folder, disguised as an eslint background task.