Two fake Upwork jobs, one infected Mac: my run-ins with North Korea's Contagious Interview

In short: Contagious Interview is a fake-recruiting attack run by North Korean hackers. They pose as clients or recruiters on platforms like Upwork and LinkedIn, and in the end they get you to run a "test project" or install a "meeting app" yourself. One rule spots it: if a hiring process asks you to run unfamiliar code on your own machine, stop. If you already ran it, go offline, look for unknown background processes and folders, change your passwords, and sign out of every logged-in device on the sites that matter.

The first time: June 2026

A client who said he was Ukrainian reached out on Upwork. He had a project and wanted my help with it, and he sent over a Node.js test project called "Online_Store".

The malicious code was hidden in one of its npm dependencies. I no longer remember exactly which package it was; I think it was something Tailwind-related. Once I ran the project, it quietly created a ~/.node_modules folder on my machine with axios and socket.io-client inside, set up to send my data out.

By the time I noticed, it had been running in the background for days. I only caught it by luck: a colleague of mine in the UK had exactly the same thing happen to him, and when he told me about it, I realized I had probably been hit too.

The second time: October 2026

This time the person said he was Lithuanian, from a capital firm called Veyron Capital (veyron[.]capital), which had posted a whole batch of Web3 jobs on Upwork.

He messaged me first, then set up a video call on Upwork. He kept his camera off, and he spoke to me in Chinese the whole time. Afterwards he asked me to add him on Telegram and pulled me into a group, where I was asked to build a Web3 demo and present it to the team in a meeting.

When it was time to present, they said a colleague was travelling and couldn't use the usual meeting tool, so we had to switch to a meeting app called "Zeff" (zeff[.]app). Someone else in the group "helped" me install it and gave me two options: run a curl | bash command in the terminal, or download a DMG.

I didn't install it. Having been burned once, the moment I saw "run this unknown command in your terminal so we can have a meeting", I knew it was the same trick.

Looking back

Both were North Korea's "Contagious Interview" attacks: fake recruiting and fake interviews. They build trust with what looks like an ordinary job, then get you to run their code with your own hands.

What bothered me most is that neither macOS's built-in XProtect nor traditional antivirus made a sound, either time.

Claude Code as my forensic investigator

After the first infection, what actually dug the problem out was Claude Code. I used Fable 5 (Max), gave it the permissions it needed, and had it go through my whole disk and my background processes like an investigator. It quickly found that the malware was still running, then walked me through cleaning everything up, step by step.

What I lost

Luckily, nothing. What this kind of malware wants most is crypto wallets, and I don't have any on that machine. The accounts I care about all have two-factor authentication turned on, so even with my passwords, nobody could log in.

One warning, though: this malware usually steals the login sessions (cookies) saved in your browser too. With those, an attacker can skip two-factor authentication and walk straight into your accounts. So if you get hit, change your passwords, and also sign out of every logged-in device on the sites that matter.

So I built a tool: Tsuba

After these two run-ins, I could see where the gap was. These attacks come in new packaging every time and use the most ordinary tools there are, like node, curl and bash, so traditional antivirus has no reason to find them suspicious.

So I built a small macOS menu bar app called Tsuba (鍔, the hand guard on a Japanese sword). The idea is simple: before unfamiliar code runs for the first time, it takes a look for you. It works out what the code is about to do, where it came from and whether it looks like a known attack, then decides whether to allow it, warn you, or block it.

Here is how it maps to my two cases:

• A fake interview project, like the first one: before you run npm install or npm start, it checks whether the dependencies are on public lists of malicious packages, and looks through the project source for hidden code, hard-coded remote addresses, or code that reads wallets and password stores. If you're still unsure, you can trial-run the project in a sandbox and watch what it actually does.
• A fake meeting app, like the second one: when it sees curl | bash, it downloads the remote script without running it and checks what it would do. Downloaded DMGs get their signature, notarization and source checked too.

Tsuba is free, and its source is on GitHub. The download for Apple silicon and Intel Macs, and everything else about it, is on the Tsuba page. If you take work on Upwork or similar platforms, or often run code other people send you, give it a try.