`https://github.com/rominamabelramirez`

https://github.com/rominamabelramirez is a GitHub account that one published source reports in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from GitLab Threat Intelligence. The report is dated 2025-09-17.

github profile Contagious Interview MATCHED IN SOURCE removed checked 2026-09-18

Listed as rominamabelramirez

First seen 2025-09-17 · last seen 2025-09-17

removed checked 2026-09-18

Source

…in the malware. The preinstall script downloads and attempts to execute a bash script named downx64.sh contained in the bai branch of the GitHub repository /RominaMabelRamirez/dify .…
Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure - GitLab Security Tech Notes — GitLab Threat Intelligence · under “macOS Delivery Chain” · published 2025-09-17 · pulled 2026-09-09

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Cited by the same report: Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure - GitLab Security Tech Notes

GitLab Threat Intelligence lists 36 other indicators in this source. 12 are shown, chosen across types.

All 37 indicators from this source