master-0420

wecreateproblems.org

domain Contagious Interview RESEARCHER POST

First seen 2026-05-18 · last seen 2026-05-18

Registration

From the registry’s RDAP record for wecreateproblems.org, looked up 2026-10-05. A hold means the domain does not resolve, usually because the registrar or registry suspended it.

Source

• Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs a complete fake interview assessment platform. The domain impersonates a real hiring-assessment product, and the article describes further variants impersonating a second one. During the assessment the candidate is shown a fake camera-driver installation with a progress indicator; no driver is installed and the step exists to cover the malware running behind it.

  x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer) · under “master-0420” · published 2026-05-18 · pulled 2026-08-30

https://github.com/master-0420

github profile Contagious Interview RESEARCHER POST live checked 2026-09-30

First seen 2026-05-18 · last seen 2026-05-18

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Source

• Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs a complete fake interview assessment platform. The domain impersonates a real hiring-assessment product, and the article describes further variants impersonating a second one. During the assessment the candidate is shown a fake camera-driver installation with a progress indicator; no driver is installed and the step exists to cover the malware running behind it.

  x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer) · under “master-0420” · published 2026-05-18 · pulled 2026-08-30