A Contagious Interview - 38413 Private Case

This case details a multi-stage Contagious Interview campaign targeting software developers. You will get to investigate an endpoint compromise that began under the guise of a routine hiring assessment, where social engineering lured a developer into cloning a malicious GitHub repository. What followed was a swift intrusion lifecycle designed to blend right into standard developer activity. Leveraging obfuscated Node.js execution and secondary Python scripts, the adversary established covert Command & Control channels, conducted host discovery, and secured persistence. The actor then harvested and exfiltrated sensitive internal documents, quietly gathering telemetry while employing defense evasion tactics to mask their presence. Important: Choose the Correct License Type Personal License For individuals paying out of their own pocket for personal skill development only. Self-funded learning Personal skill improvement No organizational benefit Enterprise License Required if any organization benefits from your use, including: Company-sponsored training Skills used for work purposes Educational institutions Team learning activities Important: If your employer is paying for this lab OR if the skills learned will benefit your employer/organization in any way, you must purchase an Enterprise license. This applies even if you're paying personally but using the skills for work. You will receive an email within 5 minutes of purchase with instructions on how to activate the lab. Buy now, use anytime within the next 3 months. Enjoy! Disclaimer All information in the DFIR Labs and analysis of that information shall be treated as TLP:RED. This classification mandates that the information is not shared publicly or privately without explicit permission from The DFIR Report. The difficulty of each DFIR Lab case is inherently subjective and may vary based on the participant's individual skills and experience.