Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

thehackernews.com Sep 22, 2026

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

Curated by Shubham · TechCapsules · Sep 22, 2026

AI-summarised brief · reviewed before publication

A joint cybersecurity advisory from Japan, the U.S., Australia, and Germany revealed that North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices in more than 100 countries and stolen over $10.71 million in cryptocurrency from 7,000+ wallets. The attackers target web designers, engineers, and blockchain specialists by posing as recruiters on LinkedIn, then deploying malware such as BeaverTail and OtterCookie to gain remote access. The operation, linked to the 313 General Bureau, also uses laptop farms and VPN services to facilitate espionage and credential theft.

💡 Why It Matters

· The scale of the breach exposes a sophisticated, state‑backed phishing network that not only drains crypto assets but also threatens intellectual property and corporate security, underscoring the growing reach of North Korean cyber operations.

Capsules Cybersecurity

Read full article on thehackernews.com

SEALSQ, WISeKey, and Canton of Jura Execute MoU for CHF 40–60M ($48.7M–$73M…

SEALSQ Corp, its parent WISeKey International Holding Ltd, and the Swiss Canton of Jura signed a Memorandum of Understanding to create the Jura Post‑Quantum Semiconductor and Cybersecurity Center. The public‑private partnership will invest CHF 40 million to CHF 60 million over six years to develop regional expertise in personalizing, testing, and certifying hardware‑embedded post‑quantum cryptography. The center will use SEALSQ’s QS7001 Quantum Shield microcontrollers, which run NIST‑standard ML‑KEM and ML‑DSA lattice algorithms, and will support defense, aerospace, and critical infrastructure sectors. The facility aims to create 250+ jobs by year eight, with over 60 % of positions held by local residents.

💡 By anchoring advanced post‑quantum hardware development in Switzerland, the project strengthens national cybersecurity resilience and positions the region as a hub for secure microelectronics, directly supporting defense and critical infrastructure needs.

thehackernews.com · Sep 21

TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data

Cybersecurity researchers uncovered TASK#STOMP, a PowerShell backdoor that harvests business documents, Wi‑Fi passwords, clipboard data, and screenshots while accepting remote commands via two token‑authenticated C2 servers. Infection begins with a disguised VBScript (“95c9050t66.vbs”) executed through wscript.exe, establishing persistence through scheduled tasks and the Startup folder. The malware employs timestomping, hidden execution, and mutual‑watchdog modules to maintain a single active session and evade detection. It also opens a Chrome window to an Iranian tender database, though the purpose remains unclear.

💡 The campaign showcases how attackers blend native Windows tools with sophisticated persistence and redundancy, making detection and removal far more difficult for defenders.

thequantuminsider.com · Sep 21

SEALSQ, WISeKey and Jura Sign MoU for Swiss Post-Quantum Semiconductor Center

SEALSQ Corp, WISeKey International Holding, and the Canton of Jura signed a memorandum of understanding to create a Post‑Quantum Semiconductor and Cybersecurity Center in the Swiss canton. The project will invest roughly CHF 40‑60 million over six years, focusing on the QS7001 Quantum Shield and related secure firmware personalization, testing, and certification. The initiative aims to generate about 40 jobs in two years, expanding to over 250 by year eight, with a majority of positions filled by local residents. The center will build on the Quantix Edge Security model in Spain and seek partnerships with Swiss academia, industry, and defense programs.

💡 By establishing a sovereign post‑quantum semiconductor hub, Switzerland could secure critical supply chains for defense and high‑security sectors, reducing reliance on foreign technology. The collaboration leverages local precision manufacturing expertise, positioning the country as a leader in quantum‑ready hardware.

thehackernews.com · Sep 21

Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK…

SentinelOne revealed that North Korean threat actor Jade Sleet targeted an India‑based IT services firm, deploying Apple macOS backdoors FLATROOF and ROOFDECK. The attack used social‑engineering job‑interview lures to compromise a DevOps engineer’s Apple Silicon MacBook, with the backdoors first detected on March 18, 2026. The implants remained dormant until March 29, then began beaconing, and a newer ROOFDECK variant appeared on April 20, 2026, stripping debug symbols to evade detection. The campaign underscores Jade Sleet’s focus on cryptocurrency and blockchain vendors.

💡 The breach demonstrates how supply‑chain attacks now hinge on developer endpoints, turning individual engineers into high‑value targets that can unlock entire cloud pipelines. This shift forces organizations to rethink security beyond perimeter defenses, prioritizing continuous monitoring of development environments.

thehackernews.com · Sep 21

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Threat actors are using ClickFix‑style lures to deliver a new remote‑access trojan dubbed ChainScript. The malware, also seen under names such as ComponentTask33 and OrchidViolet66, masquerades as legitimate software like Spotify, Zoom Workplace and Microsoft Teams. After a malicious MSI installer runs via msiexec.exe, it drops a Node.js runtime and launches a JavaScript agent through hidden PowerShell and VBScript stages, installing components in “%LOCALAPPDATA%” and persisting via a scheduled task with a Registry Run key fallback. ChainScript employs an EtherHiding‑style C2 discovery method that queries a Polygon smart contract to locate its WebSocket server, allowing the backend to rotate without changing the implant. The RAT offers full remote control, including CMD/PowerShell shells, file manipulation, screenshot capture, cryptocurrency wallet enumeration and remote JavaScript execution. The campaign, linked to the compromised HBO Max Reddit account, also distributes macOS stealers and crypto clippers, with 108 malicious ads posted over 48 hours in mid‑September 2026.

💡 By offloading C2 resolution to a blockchain contract, attackers can instantly shift infrastructure, rendering traditional takedown and signature‑based defenses ineffective. This technique signals a new frontier where decentralized platforms become core components of malware command structures.

infosecurity-magazine.com · Sep 21

Revolut Customers Targeted with New Wave of Phishing Attacks

Hackers have exploited a recent Revolut data breach to launch a smishing campaign targeting the fintech firm’s customers, Malwarebytes reported. The phishing texts, first seen on September 14, mimicked legitimate Revolut messages and urged recipients to click a link to “confirm their identity” or face account restrictions. The link directed users to a counterfeit live‑video verification page that requested camera access, then prompted for passwords, allowing attackers to capture selfies or videos for further fraud. Malwarebytes warned that if the campaign is tied to the breach, criminals could obtain enough personal data to hijack accounts. The breach appears to have focused on Revolut’s Lithuanian‑regulated entity, with threat actors impersonating Italian law enforcement to submit fraudulent KYC requests, affecting several hundred accounts, notably high‑net‑worth crypto users.

💡 The fake video‑verification trick turns a routine security step into a weapon, giving scammers biometric data that can bypass traditional authentication methods.