https://github.com/borismelnik1982-netizen
https://github.com/borismelnik1982-netizen is a GitHub account
that one published source reports
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from SlowMist.
The report is dated 2026-07-18.
github profile Contagious Interview RESEARCHER POST removed
removed
Source
-
Transcribed by hand on 27 September 2026 from SlowMist's analysis of a repository a fake Web3 recruiter sent a developer over LinkedIn. The post does not name North Korea. The cluster label rests on the malware: its HMAC key, SuperStr0ngSecret@)@^, and its layout of upload endpoints on ports 8085 and 8086 with a Socket.IO channel and /api/notify on 8087 are the same as in the stealer SANS ISC (diary 33006, 22 May 2026) tied to a DPRK OtterCookie command-and-control address and research.veryserious.systems (13 June 2026) attributed to North Korea's Contagious Interview activity. The repository and its owning account, the command-and-control address, the loader's SHA-256 and its file name are the values the post's IOC section gives; the six endpoint URLs on that address are not carried separately. Values are re-fanged and nothing else is altered.
slowmist.medium.com/threat-intelligence-analysis-of-a-github-poisoning-attack-disguised-as-recruitment-30fe23601305 — SlowMist
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.