auron-core.min.js
auron-core.min.js is a file name
that one published source reports
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from SlowMist.
The report is dated 2026-07-18.
filename Contagious Interview RESEARCHER POST
Source
-
Transcribed by hand on 27 September 2026 from SlowMist's analysis of a repository a fake Web3 recruiter sent a developer over LinkedIn. The post does not name North Korea. The cluster label rests on the malware: its HMAC key, SuperStr0ngSecret@)@^, and its layout of upload endpoints on ports 8085 and 8086 with a Socket.IO channel and /api/notify on 8087 are the same as in the stealer SANS ISC (diary 33006, 22 May 2026) tied to a DPRK OtterCookie command-and-control address and research.veryserious.systems (13 June 2026) attributed to North Korea's Contagious Interview activity. The repository and its owning account, the command-and-control address, the loader's SHA-256 and its file name are the values the post's IOC section gives; the six endpoint URLs on that address are not carried separately. Values are re-fanged and nothing else is altered.
slowmist.medium.com/threat-intelligence-analysis-of-a-github-poisoning-attack-disguised-as-recruitment-30fe23601305 — SlowMist
Find this indicator in the index, or see every file name this site holds under File names in the browse listing.