Researchers are following a social engineering-based malware campaign designed to deceive job-seeking software developers into downloading a malicious python backdoor as part of a fake interview process. The campaign is called “DEV#POPPER” and researchers have speculated that North Korea may be behind its operation. The attackers are known to make initial contact with prospective employees by posing as hiring managers looking to fill a developer role. As part of the interview process, candidates are asked to download a coding task from a GitHub repository, purportedly as a test of technical aptitude. The zip file hosted on GitHub and downloaded by the victim contains an NPM (node package manager) package along with a README.md file. When the NPM package is run, an obfuscated JavaScript file runs a curl command that downloads an archive file which itself is an obfuscated python script. The obfuscated python script is a remote access tool (RAT) with mechanisms for persistence, command execution, FTP data exfiltration, and keystrokes logging. This campaign is being waged on the heels of a similar campaign dubbed “Contagious Interview” during which attackers similarly posed as employers to coerce job-seeking developers into installing BeaverTail and InvisibleFerret malware. Both campaigns seem to target software developers specifically. DEV#POPPER has been linked to North Korea due to the social engineering technique of targeting job-seekers, which the Lazarus Group has been notorious for using in its campaigns. CTIX analysts caution those currently looking for new jobs to do proper due diligence on prospective companies prior to entering the interview process. CTIX analysts will continue to report on new and emerging malware and associated campaigns.