North Korean Hackers Turn JSON Services into Covert Malware Delivery Channels

North Korean threat actors behind the Contagious Interview campaign have adapted their tactics by leveraging JSON storage services such as JSON Keeper, JSONsilo, and npoint.io to host and deliver malicious payloads. This approach allows them to bypass traditional detection methods by embedding trojanized code within seemingly legitimate JSON files, enhancing their ability to distribute malware covertly.