RominaMabelRamirez/dify
RominaMabelRamirez/dify is a malicious repository
that one published source reports
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from GitLab Threat Intelligence.
The report is dated 2025-09-17.
malicious repository Contagious Interview CURATED Taken down
Source
-
GitHub repository GitLab Threat Intelligence found distributing a BeaverTail variant in September 2025: the downx64.sh dropper fetched two unsigned Mach-O binaries, x64nvidia and payuniversal2, from the same branch of this repository. The account name may be an assumed identity; the repository, not the person, is the indicator.
Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure — GitLab Threat Intelligence
Find this indicator in the index, or see every malicious repository this site holds under Malicious repositories in the browse listing.