`auth-rho-dun.vercel.app`

auth-rho-dun.vercel.app is a hosted site that one published source reports in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from OpenSourceMalware. The report is dated 2026-03-06.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Type	Role	Malware family	First written
`0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3`	Wallet, aptos	pointer account	DEV#POPPER.js	reported
`0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e`	Wallet, aptos	pointer account	DEV#POPPER.js	reported
`tmfkqed7tjja5xnzjz2lep838vrzrs7map`	Wallet, tron	pointer wallet	DEV#POPPER.js	reported
`txfxhuet9pjvu1bgvkbabres4yuc1ngzcg`	Wallet, tron	pointer wallet	DEV#POPPER.js	reported

hosted site Contagious Interview CURATED

First seen 2026-03-06 · last seen 2026-03-06

Source

Vercel-hosted command-and-control endpoint used by the March 2026 Neutralinojs repository compromise: hxxps://auth-rho-dun[.]vercel[.]app/api, serving a 4,777-byte obfuscated stage whose SHA-256 is a507b74b6b1e25444c586bc67ae0244cba3037f2b39f25f7eb507ded97c373c1. OpenSourceMalware reports that Vercel removed both endpoints after being alerted, and attributes the campaign to DPRK Contagious Interview from the GitHub persona and the BeaverTail final payload.
Neutralinojs Compromised In DPRK Attack — OpenSourceMalware · published 2026-03-06 · pulled 2026-10-03

Find this indicator in the index, or see every hosted site this site holds under Hosted sites in the browse listing.

Related indicators

Cited by the same report: Neutralinojs Compromised In DPRK Attack

OpenSourceMalware lists 5 other indicators in this source.