JSON services hijacked by North Korean hackers to send out malware

• The Lazarus Group used JSON storage services to host malware in the Contagious Interview campaign targeting developers
• Attackers lured victims via fake LinkedIn job offers and delivered BeaverTail, InvisibleFerret and TsunamiKit malware
• Malware exfiltrates data, steals crypto and mines Monero – while interfering with normal developer workflows

North Korean state-sponsored threat actors, part of the infamous Lazarus Group, have been seen hosting malware and other malicious code on JSON storage services.

Cyber ​​security researchers NVISIO flagged that they had seen attackers using JSON Keeper, JSONsilo and npoint.io in an attempt to remain unseen and persistent in their attacks.