{ "intelligence": { "actors": [ { "confidence": 50, "evidence_id": "cad7a501-80f1-4440-87fa-bb5993338bb7", "name": "DPRK", "role": "acteur lié (relation uses)", "type": "Intrusion-Set" } ], "counts": { "actors": 1, "associated_entity_contexts": 1, "deduplicated_iocs": 38, "direct_entities": 82, "direct_relationships": 121, "invalid_iocs": 2, "iocs": 38, "mentioned": 1, "mitre_associated": 4, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 2, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 201, "excluded_graph_objects": 774, "graph_complete": true, "graph_objects": 82, "graph_relationships": 121, "mitre_context_complete": true, "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "status_as_of": "2026-10-10T07:38:41+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:51:54.023Z", "updated_at": "2026-09-25T11:51:54.393Z" }, "description_available": false, "entity_type": "StixFile", "id": "0643520a-ced4-4e0e-9185-3715a7bc2cab", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--3114f74f-e36c-5627-9e72-571c79867da7", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:02.135Z", "updated_at": "2026-09-25T11:52:02.665Z" }, "description_available": false, "entity_type": "StixFile", "id": "06604e94-acb3-493b-a41a-6d46a3b0a1ae", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--5cec6d5b-1836-51ce-9828-99d95f10c7c3", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.935Z", "created_at": "2026-09-25T11:52:47.951Z", "modified": "2026-09-25T11:55:17.774Z", "updated_at": "2026-09-25T11:55:17.774Z" }, "description_available": false, "entity_type": "Indicator", "id": "088c5012-ddcb-4c76-8bbb-aaa384ecebbc", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--d759379f-162b-5944-bdba-8d6269a23671", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:09.361Z", "updated_at": "2026-09-25T11:52:09.796Z" }, "description_available": false, "entity_type": "StixFile", "id": "0f0568c0-f9ae-4241-b891-e68302101329", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--33eb5ece-c15b-5a66-b24b-ccf597482313", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:03.210Z", "updated_at": "2026-09-25T11:52:03.932Z" }, "description_available": false, "entity_type": "StixFile", "id": "11f41381-d95f-45ea-a338-cfa27d9fb2f8", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--d9be4686-5929-5d04-8b47-640ab2fe6bec", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.831Z", "created_at": "2026-09-25T11:52:18.943Z", "modified": "2026-09-25T11:52:25.863Z", "updated_at": "2026-09-25T11:52:25.863Z" }, "description_available": false, "entity_type": "Indicator", "id": "13c168da-e080-4318-a177-29370ad6ae75", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--9c0562bd-a9dd-51f1-9459-d182d9c1db71", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:11.476Z", "updated_at": "2026-09-25T11:52:12.270Z" }, "description_available": false, "entity_type": "StixFile", "id": "14cfd48b-331d-440b-8581-058737ad8037", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--dfe67b4e-0261-53b4-b6b1-216fa4ab8740", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.901Z", "created_at": "2026-09-25T11:52:34.996Z", "modified": "2026-09-25T11:54:40.899Z", "updated_at": "2026-09-25T11:54:40.899Z" }, "description_available": false, "entity_type": "Indicator", "id": "1772709a-daec-447f-8e9d-75dc3c2c5b7e", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--9a381c1d-b210-5df1-8045-66342915454a", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:51:52.797Z", "updated_at": "2026-09-25T11:52:50.016Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "17dbd244-67b9-4f83-913b-8e1537efa7b2", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "ipv4-addr--fb8215f6-59fc-562d-89ba-d46fa2b47ec4", "type": "IPv4Addr" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:14.522Z", "updated_at": "2026-09-25T11:52:15.226Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "1a2ec485-e8a0-4840-b8f4-dabd3689054d", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "domain-name--35dd414e-5963-54c2-bce1-332eba61d347", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:14.363Z", "updated_at": "2026-09-25T11:52:14.909Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "1b64d126-e54f-4228-98af-43af2b86191e", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "domain-name--3d30e5b4-ab2a-58af-80dd-45678a959b9e", "type": "DomainName" }, { "__typename": "Malware", "aliases": [ "js.otter_cookie" ], "attributes": { "is_family": true, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T17:55:29.115Z", "created_at": "2026-01-18T21:00:18.363Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-07T03:13:38.166Z", "updated_at": "2026-10-07T03:13:38.166Z" }, "description_available": true, "entity_type": "Malware", "id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "is_inferred": false, "labels": [ "botnet_cc", "none" ], "lang": "en", "name": "OtterCookie", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "a003a486-00e4-4366-acff-13f55cbd4691", "source_name": "Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025", "url": "https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat" }, { "external_id": null, "id": "4eadb693-b794-44cd-837a-d560248408f7", "source_name": "alien-vault", "url": "https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html" }, { "external_id": null, "id": "52fb42d3-e156-4326-834d-295d5639730c", "source_name": "malpedia", "url": "https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/" }, { "external_id": null, "id": "a848bc92-08a5-4dc3-9f43-3082138426b4", "source_name": "malpedia", "url": "https://any.run/cybersecurity-blog/lazarus-group-attacks-2025/" }, { "external_id": null, "id": "9bd3f1be-ac10-48d4-8073-a10dfa0b3720", "source_name": "malpedia", "url": "https://any.run/cybersecurity-blog/ottercookie-malware-analysis/" }, { "external_id": null, "id": "7ec6412a-26f1-4fc6-91f5-320056010a48", "source_name": "malpedia", "url": "https://blackpointcyber.com/blog/malicious-node-package-deploys-ottercookie/" }, { "external_id": null, "id": "6a0224d4-677f-4832-9b9b-49431d4404b5", "source_name": "malpedia", "url": "https://blog.daviddodda.com/how-i-almost-got-hacked-by-a-job-interview" }, { "external_id": null, "id": "5a0ec6e7-40ab-49f2-8319-db8f8d981ebb", "source_name": "malpedia", "url": "https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery/" }, { "external_id": null, "id": "e3fcb399-038e-4300-9efe-1e50fc231f95", "source_name": "malpedia", "url": "https://blog.talosintelligence.com/beavertail-and-ottercookie/" }, { "external_id": null, "id": "4ca57676-51a0-4c09-acfa-0115b1fbcf81", "source_name": "malpedia", "url": "https://cyberandramen.net/2026/04/04/ottercookie-expands-targeting-to-ai-coding-tools-analysis-of-a-trojanized-npm-campaign/" }, { "external_id": null, "id": "343c8b8a-05cb-4026-aff6-8e7c68809681", "source_name": "malpedia", "url": "https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/" }, { "external_id": null, "id": "b9e82467-ee2b-46df-b66d-d4a0daaff520", "source_name": "malpedia", "url": "https://gbhackers.com/lazarus-group-malware-with-ottercookie/" }, { "external_id": null, "id": "88958f67-8a9e-4640-883a-e8222e1205a0", "source_name": "malpedia", "url": "https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/north-korean-malware-sept-2025/" }, { "external_id": null, "id": "457b2bd5-88fe-4bd8-8b07-eb565361ade2", "source_name": "malpedia", "url": "https://jp.security.ntt/insights_resources/tech_blog/en-contagious-interview-ottercookie/" }, { "external_id": null, "id": "25690beb-b479-4a2f-9ecd-bd06bfc19d81", "source_name": "malpedia", "url": "https://jp.security.ntt/insights_resources/tech_blog/en-waterplum-ottercookie/" }, { "external_id": null, "id": "e782a2da-2970-4f99-8f70-1f7df99fc4e5", "source_name": "malpedia", "url": "https://jp.security.ntt/tech_blog/contagious-interview-ottercookie" }, { "external_id": null, "id": "4dd294b9-6174-45aa-b125-153a472f605f", "source_name": "malpedia", "url": "https://jp.security.ntt/tech_blog/en-waterplum-ottercookie" }, { "external_id": null, "id": "9635d6a9-8417-4428-8b0e-c42ce1683206", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/js.otter_cookie" }, { "external_id": null, "id": "f3bcc7a2-7c6b-42c2-8a81-5a82b8560b6f", "source_name": "malpedia", "url": "https://medium.com/deriv-tech/how-a-fake-ai-recruiter-delivers-five-staged-malware-disguised-as-a-dream-job-64cc68fec263" }, { "external_id": null, "id": "d51a1b37-04e0-4340-91b7-b100546114c4", "source_name": "malpedia", "url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit" }, { "external_id": null, "id": "18112d8b-4293-4ba8-8050-1dced26523e7", "source_name": "malpedia", "url": "https://panther.com/blog/jsonspack-multi-tenant-node.js-rat-%E2%80%94-dprk-supply-chain-campaign" }, { "external_id": null, "id": "ca91ada9-bfd6-49c9-b5b6-530baddb55fd", "source_name": "malpedia", "url": "https://quetzal.bitso.com/p/interview-with-the-chollima" }, { "external_id": null, "id": "ca5df5b5-1875-4b19-9cf5-9ead3ec7b694", "source_name": "malpedia", "url": "https://redasgard.com/blog/hunting-lazarus-part7-server-not-just-ftp" }, { "external_id": null, "id": "e66dc611-f8ec-460d-95df-5359a72e5eaf", "source_name": "malpedia", "url": "https://research.jfrog.com/post/rollup-polyfill-masquerading/" }, { "external_id": null, "id": "74df00b0-05c3-411f-92d1-7fcfd0fb668e", "source_name": "malpedia", "url": "https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf" }, { "external_id": null, "id": "32f07402-f8ba-4419-81a0-dfdcdd87438e", "source_name": "malpedia", "url": "https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography" }, { "external_id": null, "id": "67c527eb-024c-4253-b024-436996fb61cb", "source_name": "malpedia", "url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/" }, { "external_id": null, "id": "81da49fb-9157-417b-8f07-ea29bb353dd2", "source_name": "malpedia", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/" }, { "external_id": null, "id": "81496696-24fd-4874-8388-497590c49d9a", "source_name": "malpedia", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/" }, { "external_id": null, "id": "582857b1-4900-45ff-9ae3-d34347507acc", "source_name": "malpedia", "url": "https://www.silentpush.com/blog/contagious-interview-front-companies/" }, { "external_id": null, "id": "33d0cc5e-af3e-4f1a-830d-045d480aafb4", "source_name": "malpedia", "url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2025/papers/DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdf" }, { "external_id": null, "id": "86383930-f13f-4006-9151-276c1a81a268", "source_name": "malpedia", "url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-from-primitive-crypto-theft-to-sophisticated-ai-based-deception/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "malware--acc69881-708f-5a06-9563-91cf0ee1bf1c", "type": "Malware" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:13.366Z", "updated_at": "2026-09-25T11:52:14.040Z" }, "description_available": false, "entity_type": "Url", "id": "219bb01d-c675-4815-9bdb-e9c88dbc1615", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "url--cd97308b-f3a3-5691-9ee7-3738d274a541", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.839Z", "created_at": "2026-09-25T11:52:21.732Z", "modified": "2026-09-25T11:52:35.285Z", "updated_at": "2026-09-25T11:52:35.285Z" }, "description_available": false, "entity_type": "Indicator", "id": "234a9ea3-c046-4ae1-9f1e-e0b7a76073a3", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--7e68debb-6d2d-547e-9cec-38a4103a8379", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:14.523Z", "updated_at": "2026-09-25T11:52:15.224Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "27da3931-253c-48c7-bab2-0cfc5600b3e5", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "domain-name--8229d022-c8f0-5daf-9ff5-f433e46e19ee", "type": "DomainName" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:11.467Z", "updated_at": "2026-09-25T11:52:12.178Z" }, "description_available": false, "entity_type": "StixFile", "id": "2f70ef8a-e52b-4d8e-918e-713658c4b7c6", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--36889dc4-690a-5f1e-bc98-e099dcfc94e6", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:51:58.174Z", "updated_at": "2026-09-25T11:52:00.493Z" }, "description_available": false, "entity_type": "StixFile", "id": "308af10a-5a6f-4cc0-ad83-1e437c079166", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--7c52f8c1-c4a6-5db3-a5c2-08d9b2931d89", "type": "StixFile" }, { "__typename": "IntrusionSet", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:16:18.940Z", "created_at": "2026-02-26T09:42:16.630Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-02-26T09:42:16.962Z", "updated_at": "2026-02-26T09:42:16.962Z" }, "description_available": false, "entity_type": "Intrusion-Set", "id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "is_inferred": false, "labels": [], "lang": "en", "name": "DPRK", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "intrusion-set--5b635a52-a23d-53a8-8296-dd54ac2e6927", "type": "IntrusionSet" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:51:54.033Z", "updated_at": "2026-09-25T11:51:54.395Z" }, "description_available": false, "entity_type": "StixFile", "id": "35b48a02-f7ea-42de-a2f3-fc2bf47ed944", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--4ad67dd5-d680-52f6-b388-a108fc704abb", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.834Z", "created_at": "2026-09-25T11:52:18.944Z", "modified": "2026-09-25T11:52:24.055Z", "updated_at": "2026-09-25T11:52:24.055Z" }, "description_available": false, "entity_type": "Indicator", "id": "37aa4704-03f7-42da-ae3a-82dc2766e422", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--db1f48e8-2da9-5123-a0cf-a8b4d56a625a", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:05.587Z", "updated_at": "2026-09-25T11:52:06.710Z" }, "description_available": false, "entity_type": "StixFile", "id": "39e6a339-988a-4f54-89c8-4ed04fbec74a", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--c2ce3212-bc69-5998-acf0-8cf54fa69d91", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.894Z", "created_at": "2026-09-25T11:52:33.657Z", "modified": "2026-09-25T11:54:33.919Z", "updated_at": "2026-09-25T11:54:33.919Z" }, "description_available": false, "entity_type": "Indicator", "id": "3c0e91a6-24ec-4293-b3f3-fb81cb97b406", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--4723f948-cf9e-51c2-a5c2-da97535c03d1", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:07.696Z", "updated_at": "2026-09-25T11:52:07.879Z" }, "description_available": false, "entity_type": "StixFile", "id": "405c868f-69a3-4000-b890-78fb7c22e7bd", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--27e19ee6-f1d9-55d7-87f0-8c6c1aa1068c", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.843Z", "created_at": "2026-09-25T11:52:21.728Z", "modified": "2026-09-25T11:52:32.311Z", "updated_at": "2026-09-25T11:52:32.311Z" }, "description_available": false, "entity_type": "Indicator", "id": "41215419-0aec-4d9e-b644-164c3ae23d84", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--211af71f-c3ac-5934-833c-0403add57eb7", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.888Z", "created_at": "2026-09-25T11:52:32.618Z", "modified": "2026-09-25T11:54:17.062Z", "updated_at": "2026-09-25T11:54:17.062Z" }, "description_available": false, "entity_type": "Indicator", "id": "412677ee-1325-4a19-9df1-a4d741481d14", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--83774698-1be6-5189-9a72-aef2dfce9445", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:51:56.021Z", "updated_at": "2026-09-25T11:51:56.675Z" }, "description_available": false, "entity_type": "StixFile", "id": "42d26cd1-6154-42e5-bbfb-bf77c7608035", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--675e079f-fe3e-583e-8e55-198961a813bc", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:51:56.357Z", "updated_at": "2026-09-25T11:51:56.892Z" }, "description_available": false, "entity_type": "StixFile", "id": "525370a3-5324-4043-b163-d2f87a227112", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--491d0392-2098-5c1b-9a5d-81a51324d845", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.846Z", "created_at": "2026-09-25T11:52:21.869Z", "modified": "2026-09-25T11:52:37.085Z", "updated_at": "2026-09-25T11:52:37.085Z" }, "description_available": false, "entity_type": "Indicator", "id": "53901640-201f-481f-9d1b-cac560beffa4", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--c9b40a99-749d-5ca9-b2fa-80e55f7c59f4", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.938Z", "created_at": "2026-09-25T11:52:47.948Z", "modified": "2026-09-25T11:55:15.999Z", "updated_at": "2026-09-25T11:55:15.999Z" }, "description_available": false, "entity_type": "Indicator", "id": "560ba96f-13c9-4bcb-960b-6dfab539fb8a", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--957fb11f-be7a-53fa-92b8-8bcfba303651", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.870Z", "created_at": "2026-09-25T11:52:30.609Z", "modified": "2026-09-25T11:53:50.548Z", "updated_at": "2026-09-25T11:53:50.548Z" }, "description_available": false, "entity_type": "Indicator", "id": "58dc0886-3aa4-49c4-b463-59d8ac72cae9", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--f9e5d1b6-24ae-50c1-aad3-5c9b605689a9", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:04.467Z", "updated_at": "2026-09-25T11:52:05.140Z" }, "description_available": false, "entity_type": "StixFile", "id": "5da623b3-aa98-4229-a4ce-b747e5228300", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--e50426fd-b951-5968-8a4a-c08291265312", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:16.024Z", "updated_at": "2026-09-25T11:52:17.558Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "5e37862a-8c99-4be9-833c-f62a683a38f4", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "domain-name--12d1e6ef-3da8-55b9-acfc-e8c50f7acd6c", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.913Z", "created_at": "2026-09-25T11:52:38.139Z", "modified": "2026-09-25T11:54:53.537Z", "updated_at": "2026-09-25T11:54:53.537Z" }, "description_available": false, "entity_type": "Indicator", "id": "619faf2c-6b63-4018-b17c-8252061a1863", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--c1d1002a-1f3d-5525-9895-43952b78a452", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.898Z", "created_at": "2026-09-25T11:52:34.887Z", "modified": "2026-09-25T11:54:38.700Z", "updated_at": "2026-09-25T11:54:38.700Z" }, "description_available": false, "entity_type": "Indicator", "id": "64386b14-02bd-437b-bf1a-c0fffba71589", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--1282146d-bda0-55e1-9e05-0f4971d94775", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.849Z", "created_at": "2026-09-25T11:52:24.526Z", "modified": "2026-09-25T11:52:41.267Z", "updated_at": "2026-09-25T11:52:41.267Z" }, "description_available": false, "entity_type": "Indicator", "id": "65641956-bff9-4e27-b299-bf435f691e17", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--4f9d14ff-4581-5dba-82fa-6df313cf439b", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:02.135Z", "updated_at": "2026-09-25T11:52:02.664Z" }, "description_available": false, "entity_type": "StixFile", "id": "6bf31ff2-35f3-4e3a-a3b7-b6ace11b7df2", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--4c58fa51-62bf-5a05-b42d-6f5882c582fa", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.852Z", "created_at": "2026-09-25T11:52:24.807Z", "modified": "2026-09-25T11:52:43.927Z", "updated_at": "2026-09-25T11:52:43.927Z" }, "description_available": false, "entity_type": "Indicator", "id": "6d0063b1-2b5b-4f43-8f51-3818e9a9a2be", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--b23b705c-709d-5447-82c4-54506a29d4da", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.878Z", "created_at": "2026-09-25T11:52:31.651Z", "modified": "2026-09-25T11:53:58.385Z", "updated_at": "2026-09-25T11:53:58.385Z" }, "description_available": false, "entity_type": "Indicator", "id": "727b88a4-91e7-4208-8159-31e696bc23f2", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--ffb3cd02-f689-5b2f-9930-b15181fc8da3", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.837Z", "created_at": "2026-09-25T11:52:19.231Z", "modified": "2026-09-25T11:52:29.898Z", "updated_at": "2026-09-25T11:52:29.898Z" }, "description_available": false, "entity_type": "Indicator", "id": "734b916d-dd15-49cc-9a97-484b387c9dc8", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--901949bc-967e-53a8-ad35-523d9084e02b", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:09.494Z", "updated_at": "2026-09-25T11:52:10.031Z" }, "description_available": false, "entity_type": "StixFile", "id": "74f75ec4-6d41-4690-a1c2-ff913ccbc6bf", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--f5ba35dc-8602-56ce-9f01-ba7025f6afb5", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.858Z", "created_at": "2026-09-25T11:52:26.201Z", "modified": "2026-09-25T11:52:58.790Z", "updated_at": "2026-09-25T11:52:58.790Z" }, "description_available": false, "entity_type": "Indicator", "id": "75943aae-80ff-42fb-aa8d-66545e137b5e", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--23527787-46d2-5a10-9d8a-b2a4ddb41959", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:11.472Z", "updated_at": "2026-09-25T11:52:12.269Z" }, "description_available": false, "entity_type": "StixFile", "id": "75bda196-60cc-4651-8621-816983bbfc37", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--195ea89b-a353-5cdd-a1a3-6643e80ec9ca", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.866Z", "created_at": "2026-09-25T11:52:29.984Z", "modified": "2026-09-25T11:53:30.872Z", "updated_at": "2026-09-25T11:53:30.872Z" }, "description_available": false, "entity_type": "Indicator", "id": "837458c2-5235-4325-afee-a00f4d014b7d", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--179fb566-e1b7-5bd8-86ff-328273681bc5", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:16.267Z", "updated_at": "2026-09-25T11:52:17.995Z" }, "description_available": false, "entity_type": "Hostname", "id": "84435134-e86f-42f2-8cd9-543dc745f3e2", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "hostname--faf33128-e8a8-530e-afac-414165fcf272", "type": "Hostname" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:51:52.620Z", "updated_at": "2026-09-25T11:51:53.012Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "84fb7845-8474-4b0a-902d-864a3d09a81d", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "domain-name--3544c746-05ef-517a-9118-21a073ac505e", "type": "DomainName" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:51:56.363Z", "updated_at": "2026-09-25T11:51:57.345Z" }, "description_available": false, "entity_type": "StixFile", "id": "8748c44d-fa7b-4aea-a0bd-21c5b3f2f2f2", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--46cd108f-5ba4-5aab-9788-08b415f8c332", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.919Z", "created_at": "2026-09-25T11:52:41.343Z", "modified": "2026-09-25T11:54:59.181Z", "updated_at": "2026-09-25T11:54:59.181Z" }, "description_available": false, "entity_type": "Indicator", "id": "88511034-5c64-443a-9d7b-80930844bff3", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--f5d06933-2b86-530b-9cb1-a9e6683a4f02", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:51:58.386Z", "updated_at": "2026-09-25T11:52:00.495Z" }, "description_available": false, "entity_type": "StixFile", "id": "8dce0d37-1027-4edc-b0eb-a6caea2879d8", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--09d40e11-d3e8-54ee-90a8-f8683d5e4ec5", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.954Z", "created_at": "2026-09-25T11:53:02.257Z", "modified": "2026-09-25T11:55:25.288Z", "updated_at": "2026-09-25T11:55:25.288Z" }, "description_available": false, "entity_type": "Indicator", "id": "8e3c2799-5d73-44fc-82fe-2eb228196f2b", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--d2bd3400-d5b2-50bc-90a4-96d4bdbd26ed", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.922Z", "created_at": "2026-09-25T11:52:41.581Z", "modified": "2026-09-25T11:55:01.288Z", "updated_at": "2026-09-25T11:55:01.288Z" }, "description_available": false, "entity_type": "Indicator", "id": "9127dee6-f591-4bdd-b5b6-47d72e9fa3d8", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--00ca3abc-31c3-5b91-8fe8-7d5004e518c3", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:51:53.824Z", "updated_at": "2026-09-25T11:51:54.209Z" }, "description_available": false, "entity_type": "StixFile", "id": "950f054c-e6c3-4289-9348-2226f2b340f1", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--158d74f1-6f48-5bf4-bafa-b729803045c1", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.925Z", "created_at": "2026-09-25T11:52:42.991Z", "modified": "2026-09-25T11:55:05.666Z", "updated_at": "2026-09-25T11:55:05.666Z" }, "description_available": false, "entity_type": "Indicator", "id": "9721ed52-bb84-4c69-85e7-694a66829f01", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--ace84e11-7553-596c-8202-af467be41089", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.861Z", "created_at": "2026-09-25T11:52:26.994Z", "modified": "2026-09-25T11:53:22.242Z", "updated_at": "2026-09-25T11:53:22.242Z" }, "description_available": false, "entity_type": "Indicator", "id": "991685f9-2157-443c-a061-71dbcd5e6464", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--ee51ed51-f843-5f13-871b-280d04752fb0", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.927Z", "created_at": "2026-09-25T11:52:43.345Z", "modified": "2026-09-25T11:55:10.610Z", "updated_at": "2026-09-25T11:55:10.610Z" }, "description_available": false, "entity_type": "Indicator", "id": "9e2bc73a-d14e-46e2-a2f7-dc8561e12691", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--c011e551-7bb9-590f-adb8-64e913c8cc67", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.940Z", "created_at": "2026-09-25T11:52:53.887Z", "modified": "2026-09-25T11:55:19.402Z", "updated_at": "2026-09-25T11:55:19.402Z" }, "description_available": false, "entity_type": "Indicator", "id": "a0f18bcc-902d-4beb-a755-3c962dd9287b", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--7e66c836-8695-5fef-ace3-83b3f39bfb26", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:16.261Z", "updated_at": "2026-09-25T11:52:17.994Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "a18a3441-9d37-4f90-aef5-c93a6de2bb1b", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "domain-name--1766d2c5-f6df-5195-b746-83e471ec74fb", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.956Z", "created_at": "2026-09-25T11:53:04.937Z", "modified": "2026-09-25T11:55:30.115Z", "updated_at": "2026-09-25T11:55:30.115Z" }, "description_available": false, "entity_type": "Indicator", "id": "a2c30c66-ab6e-44c7-b7e9-2b8bdb2b9952", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--a7327072-7ab9-55ef-ae28-41a40872606f", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:08.006Z", "updated_at": "2026-09-25T11:52:08.874Z" }, "description_available": false, "entity_type": "StixFile", "id": "a2d41cfc-5095-4ce6-aff6-635aeee6c7fc", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--60423140-0ab5-5d52-9f30-ca762a0e2a93", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.864Z", "created_at": "2026-09-25T11:52:27.026Z", "modified": "2026-09-25T11:53:06.845Z", "updated_at": "2026-09-25T11:53:06.845Z" }, "description_available": false, "entity_type": "Indicator", "id": "a4bd22c2-eb04-48d5-9f15-1dceadbb688d", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--4859eba5-dc94-5af4-bafb-e684f334a1cf", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.930Z", "created_at": "2026-09-25T11:52:43.341Z", "modified": "2026-09-25T11:55:08.579Z", "updated_at": "2026-09-25T11:55:08.579Z" }, "description_available": false, "entity_type": "Indicator", "id": "aace7129-2520-4848-b85e-5a25a67c504d", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--1c375161-e50f-5263-8774-62bbc61a7b23", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.875Z", "created_at": "2026-09-25T11:52:30.631Z", "modified": "2026-09-25T11:53:39.501Z", "updated_at": "2026-09-25T11:53:39.501Z" }, "description_available": false, "entity_type": "Indicator", "id": "add851a1-8632-4f9a-ae8a-51220e541239", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--ff4d95b2-8281-5194-8fd0-67e35e633612", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.945Z", "created_at": "2026-09-25T11:52:55.695Z", "modified": "2026-09-25T11:55:21.982Z", "updated_at": "2026-09-25T11:55:21.982Z" }, "description_available": false, "entity_type": "Indicator", "id": "ae2832ba-bddc-4c16-86f3-1c9cd4b84b0a", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--4325b447-9ac7-5b33-bdc5-4a5e6a36aa80", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:05.584Z", "updated_at": "2026-09-25T11:52:06.708Z" }, "description_available": false, "entity_type": "StixFile", "id": "af917cd2-d0a5-476c-bf64-ea8df763bdf3", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--b9abccf8-8aa5-5c67-a103-f9bc4d89cb20", "type": "StixFile" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:13.088Z", "updated_at": "2026-09-25T11:52:13.704Z" }, "description_available": false, "entity_type": "Url", "id": "b131436d-65d7-403e-8cb3-6964a265bf65", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "url--3af4139a-b76d-54ea-8aeb-48400d356ea5", "type": "Url" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:09.251Z", "updated_at": "2026-09-25T11:52:09.553Z" }, "description_available": false, "entity_type": "StixFile", "id": "b4907ef6-d3df-4fac-94ef-95caa0f83cf4", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--dec1bbe1-5f10-5d23-bc78-a1e5fcd6c628", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:01.912Z", "updated_at": "2026-09-25T11:52:02.311Z" }, "description_available": false, "entity_type": "StixFile", "id": "b9ffc425-5be9-4c77-affd-095f595995a1", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--254d231b-a0b4-5140-99da-13ddab2bdbd5", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.883Z", "created_at": "2026-09-25T11:52:32.522Z", "modified": "2026-09-25T11:54:06.846Z", "updated_at": "2026-09-25T11:54:06.846Z" }, "description_available": false, "entity_type": "Indicator", "id": "c3310886-218b-45d9-bc70-032b0ec0b693", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--021de9ec-a97b-5bdb-819e-d4a119954907", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:06.946Z", "updated_at": "2026-09-25T11:52:07.342Z" }, "description_available": false, "entity_type": "StixFile", "id": "c381928e-6745-405a-8959-09a2c387ad02", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--85132f31-de0e-55ac-9c21-c9f12c1fb9bd", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:51:58.077Z", "updated_at": "2026-09-25T11:51:58.804Z" }, "description_available": false, "entity_type": "StixFile", "id": "c553810c-ad5a-42de-b87a-dd64bb427e41", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--84a553d7-5adf-51dd-b6c7-648a4ce9fc86", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:07.864Z", "updated_at": "2026-09-25T11:52:08.756Z" }, "description_available": false, "entity_type": "StixFile", "id": "c59e4b72-37d4-472b-bef4-6bca94deb827", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--7f98eec5-ef06-5f45-b180-76433278b27c", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:03.467Z", "updated_at": "2026-09-25T11:52:03.974Z" }, "description_available": false, "entity_type": "StixFile", "id": "c5b4d0cb-f102-49f0-8421-97e33fb26b03", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--b934f9c2-bbf6-5fbc-b98f-06b7b4a7511a", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.907Z", "created_at": "2026-09-25T11:52:36.774Z", "modified": "2026-09-25T11:54:47.854Z", "updated_at": "2026-09-25T11:54:47.854Z" }, "description_available": false, "entity_type": "Indicator", "id": "c6c50dcc-b0c4-47d9-a28a-42fa5812f363", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--5a207594-56da-5d4e-b71b-af413943889d", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.933Z", "created_at": "2026-09-25T11:52:46.699Z", "modified": "2026-09-25T11:55:11.773Z", "updated_at": "2026-09-25T11:55:11.773Z" }, "description_available": false, "entity_type": "Indicator", "id": "c978d5c5-874a-4994-aafb-baf0cfbc546c", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--f2bbbc78-2fc9-5f19-9644-e80e037e4856", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.910Z", "created_at": "2026-09-25T11:52:37.141Z", "modified": "2026-09-25T11:54:49.607Z", "updated_at": "2026-09-25T11:54:49.607Z" }, "description_available": false, "entity_type": "Indicator", "id": "cdb862f5-4342-4092-b1c9-cc4d537dd63d", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--98065a2d-0573-531d-ae09-e4cb72e537a2", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:03.470Z", "updated_at": "2026-09-25T11:52:03.975Z" }, "description_available": false, "entity_type": "StixFile", "id": "d10f84bc-9c27-42d8-a851-25134aa9ae02", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "file--4750dfcd-dfbe-5fb4-a6bd-bbae9d40ae2d", "type": "StixFile" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:52:13.339Z", "updated_at": "2026-09-25T11:52:14.039Z" }, "description_available": false, "entity_type": "Url", "id": "d576c37a-8763-4066-a1e8-a6d792526fc5", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "url--b8e2f299-861e-5872-9340-dc72f52ead3a", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.949Z", "created_at": "2026-09-25T11:52:56.916Z", "modified": "2026-09-25T11:55:23.511Z", "updated_at": "2026-09-25T11:55:23.511Z" }, "description_available": false, "entity_type": "Indicator", "id": "d72fea1f-55d7-417a-99e7-f1978950ed30", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--ef1a39bb-0b21-585b-aca9-4735a617253e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.916Z", "created_at": "2026-09-25T11:52:40.984Z", "modified": "2026-09-25T11:54:55.244Z", "updated_at": "2026-09-25T11:54:55.244Z" }, "description_available": false, "entity_type": "Indicator", "id": "d775665b-ce37-4a20-89bf-ac239e81206d", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--5d0ba76f-9467-5066-8b09-67792bf7e8c5", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.959Z", "created_at": "2026-09-25T11:53:04.941Z", "modified": "2026-09-25T11:55:31.434Z", "updated_at": "2026-09-25T11:55:31.434Z" }, "description_available": false, "entity_type": "Indicator", "id": "dde6682e-e42d-4559-9608-572ef3162eb6", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--2b75ceba-f6a4-5abe-b838-9c88ca07a611", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.855Z", "created_at": "2026-09-25T11:52:24.808Z", "modified": "2026-09-25T11:52:49.654Z", "updated_at": "2026-09-25T11:52:49.654Z" }, "description_available": false, "entity_type": "Indicator", "id": "dfd780c5-f296-49ac-ac71-bcb02c73a5fb", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--9add9fcf-3972-53e1-9d92-d74c3d47e84c", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.904Z", "created_at": "2026-09-25T11:52:35.867Z", "modified": "2026-09-25T11:54:45.010Z", "updated_at": "2026-09-25T11:54:45.010Z" }, "description_available": false, "entity_type": "Indicator", "id": "f2bb45a8-55e9-473a-8289-abb916ab5b5e", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "indicator--d8f268c0-a06b-59d7-8726-877b53540c9b", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T11:51:52.645Z", "updated_at": "2026-09-25T11:51:56.116Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "f627b03b-c9e7-4fcc-b282-404d03a6c541", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "ipv4-addr--989d5b53-a266-5e1f-ac28-b1b03743064c", "type": "IPv4Addr" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.421Z", "created_at": "2026-09-25T12:09:21.651Z", "modified": "2026-09-25T12:09:22.075Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:09:22.075Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a0f18bcc-902d-4beb-a755-3c962dd9287b", "from_id": "a0f18bcc-902d-4beb-a755-3c962dd9287b", "from_name": null, "from_type": "Indicator", "id": "033ba1d7-5d9c-4d25-8853-b198d8d9625b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--ca87a721-61c4-538e-8c0f-49b499ea8ca3", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.074Z", "created_at": "2026-09-25T11:57:22.833Z", "modified": "2026-09-25T11:57:23.051Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:57:23.051Z" }, "description_available": false, "entity_type": "indicates", "fromId": "75943aae-80ff-42fb-aa8d-66545e137b5e", "from_id": "75943aae-80ff-42fb-aa8d-66545e137b5e", "from_name": null, "from_type": "Indicator", "id": "03d498aa-cd0c-475e-8eeb-23e0ebfea6e7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--7fc638ed-8ebd-5374-ad26-7b72bc77e071", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.900Z", "created_at": "2026-09-25T11:54:54.176Z", "modified": "2026-09-25T11:54:54.430Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:54.430Z" }, "description_available": false, "entity_type": "based-on", "fromId": "64386b14-02bd-437b-bf1a-c0fffba71589", "from_id": "64386b14-02bd-437b-bf1a-c0fffba71589", "from_name": null, "from_type": "Indicator", "id": "05e22e74-8e4b-49cb-a4a6-4b4764e23388", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--4b3feb91-a61e-5107-8eae-a53136d9048f", "toId": "af917cd2-d0a5-476c-bf64-ea8df763bdf3", "to_id": "af917cd2-d0a5-476c-bf64-ea8df763bdf3", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.062Z", "created_at": "2026-09-25T11:57:09.580Z", "modified": "2026-09-25T11:57:09.842Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:57:09.842Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dfd780c5-f296-49ac-ac71-bcb02c73a5fb", "from_id": "dfd780c5-f296-49ac-ac71-bcb02c73a5fb", "from_name": null, "from_type": "Indicator", "id": "05ff0287-e79a-435e-ab0f-aa1151c478b2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--612f5153-b85f-5b2d-aa0d-ffdd39b59672", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.455Z", "created_at": "2026-09-25T12:09:47.860Z", "modified": "2026-09-25T12:09:49.089Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:09:49.089Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d72fea1f-55d7-417a-99e7-f1978950ed30", "from_id": "d72fea1f-55d7-417a-99e7-f1978950ed30", "from_name": null, "from_type": "Indicator", "id": "06edc5cb-a165-483a-a88f-1ea0f2d3261f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--6fccfb18-8238-5b3f-83f2-7b658eff931c", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.269Z", "created_at": "2026-09-25T12:05:10.632Z", "modified": "2026-09-25T12:05:12.391Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:05:12.391Z" }, "description_available": false, "entity_type": "indicates", "fromId": "619faf2c-6b63-4018-b17c-8252061a1863", "from_id": "619faf2c-6b63-4018-b17c-8252061a1863", "from_name": null, "from_type": "Indicator", "id": "09af7185-c90c-4d27-9061-2c524b5f66ca", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--17049e1b-afe7-5cfc-b89d-d781d914829b", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.952Z", "created_at": "2026-09-25T11:55:03.779Z", "modified": "2026-09-25T11:55:04.383Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:04.383Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d72fea1f-55d7-417a-99e7-f1978950ed30", "from_id": "d72fea1f-55d7-417a-99e7-f1978950ed30", "from_name": null, "from_type": "Indicator", "id": "09f7304e-e579-4da2-8548-459aad168f09", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--b6393241-6497-5d0d-91ce-93533a7b1133", "toId": "1a2ec485-e8a0-4840-b8f4-dabd3689054d", "to_id": "1a2ec485-e8a0-4840-b8f4-dabd3689054d", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.847Z", "created_at": "2026-09-25T11:54:45.768Z", "modified": "2026-09-25T11:54:47.688Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:47.688Z" }, "description_available": false, "entity_type": "based-on", "fromId": "53901640-201f-481f-9d1b-cac560beffa4", "from_id": "53901640-201f-481f-9d1b-cac560beffa4", "from_name": null, "from_type": "Indicator", "id": "0bf3e46c-d625-4b96-8d59-2402ceb259a2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--b43bbf1d-f767-588b-883b-7b296b14df1a", "toId": "35b48a02-f7ea-42de-a2f3-fc2bf47ed944", "to_id": "35b48a02-f7ea-42de-a2f3-fc2bf47ed944", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.117Z", "created_at": "2026-09-25T11:58:00.491Z", "modified": "2026-09-25T11:58:01.319Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:58:01.319Z" }, "description_available": false, "entity_type": "indicates", "fromId": "837458c2-5235-4325-afee-a00f4d014b7d", "from_id": "837458c2-5235-4325-afee-a00f4d014b7d", "from_name": null, "from_type": "Indicator", "id": "0e4c66fe-b94f-4c31-9c62-a606522f697d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--ae89c660-01d3-5c20-af64-21361a91b432", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.939Z", "created_at": "2026-09-25T11:55:02.640Z", "modified": "2026-09-25T11:55:03.285Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:03.285Z" }, "description_available": false, "entity_type": "based-on", "fromId": "560ba96f-13c9-4bcb-960b-6dfab539fb8a", "from_id": "560ba96f-13c9-4bcb-960b-6dfab539fb8a", "from_name": null, "from_type": "Indicator", "id": "0ea5bff6-5905-48d1-9978-f74c23fe8741", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--02e0a8ae-024c-5ab7-b1cd-7dbe615addf0", "toId": "219bb01d-c675-4815-9bdb-e9c88dbc1615", "to_id": "219bb01d-c675-4815-9bdb-e9c88dbc1615", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.914Z", "created_at": "2026-09-25T11:54:58.652Z", "modified": "2026-09-25T11:54:59.249Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:59.249Z" }, "description_available": false, "entity_type": "based-on", "fromId": "619faf2c-6b63-4018-b17c-8252061a1863", "from_id": "619faf2c-6b63-4018-b17c-8252061a1863", "from_name": null, "from_type": "Indicator", "id": "0f3770dd-b09d-44f4-ba8d-e85fbdd1a27d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--02c3fd99-a081-5954-8856-c4fb3faa3e58", "toId": "a2d41cfc-5095-4ce6-aff6-635aeee6c7fc", "to_id": "a2d41cfc-5095-4ce6-aff6-635aeee6c7fc", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.101Z", "created_at": "2026-09-25T11:57:45.751Z", "modified": "2026-09-25T11:57:47.519Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:57:47.519Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a4bd22c2-eb04-48d5-9f15-1dceadbb688d", "from_id": "a4bd22c2-eb04-48d5-9f15-1dceadbb688d", "from_name": null, "from_type": "Indicator", "id": "0fe259fb-463f-4e7c-b778-278f5f19a1fd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--a23455a8-13ed-5249-8370-49c7dd3e24b2", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.334Z", "created_at": "2026-09-25T12:07:12.821Z", "modified": "2026-09-25T12:07:13.816Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:07:13.816Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9e2bc73a-d14e-46e2-a2f7-dc8561e12691", "from_id": "9e2bc73a-d14e-46e2-a2f7-dc8561e12691", "from_name": null, "from_type": "Indicator", "id": "1097a569-aad2-47fa-8e32-9f2d52cd9240", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--4241b29a-134e-5705-9766-28fe12d59462", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.118Z", "created_at": "2026-09-25T11:58:11.808Z", "modified": "2026-09-25T11:58:11.953Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:58:11.953Z" }, "description_available": false, "entity_type": "indicates", "fromId": "837458c2-5235-4325-afee-a00f4d014b7d", "from_id": "837458c2-5235-4325-afee-a00f4d014b7d", "from_name": null, "from_type": "Indicator", "id": "11a5397d-d9d9-42b9-a090-6cae95632afe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--36a240c9-0edd-5c48-ab43-4b2e229ac230", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.210Z", "created_at": "2026-09-25T11:59:33.130Z", "modified": "2026-09-25T11:59:33.310Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:59:33.310Z" }, "description_available": false, "entity_type": "indicates", "fromId": "64386b14-02bd-437b-bf1a-c0fffba71589", "from_id": "64386b14-02bd-437b-bf1a-c0fffba71589", "from_name": null, "from_type": "Indicator", "id": "12572d95-48bc-4555-9168-0ec478310c4d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--2a4c992c-8a33-565e-9160-3a3b5f2dfc3d", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.947Z", "created_at": "2026-09-25T11:55:03.481Z", "modified": "2026-09-25T11:55:04.047Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:04.047Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ae2832ba-bddc-4c16-86f3-1c9cd4b84b0a", "from_id": "ae2832ba-bddc-4c16-86f3-1c9cd4b84b0a", "from_name": null, "from_type": "Indicator", "id": "139e2d10-f77e-4bfd-9490-248f5e2f756e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--a7157cdb-ed8d-5b4f-809e-baf651ef0fe1", "toId": "27da3931-253c-48c7-bab2-0cfc5600b3e5", "to_id": "27da3931-253c-48c7-bab2-0cfc5600b3e5", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.881Z", "created_at": "2026-09-25T11:54:52.808Z", "modified": "2026-09-25T11:54:53.375Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:53.375Z" }, "description_available": false, "entity_type": "based-on", "fromId": "727b88a4-91e7-4208-8159-31e696bc23f2", "from_id": "727b88a4-91e7-4208-8159-31e696bc23f2", "from_name": null, "from_type": "Indicator", "id": "186ed51b-eafa-48ee-b44c-d4121f8b6e8b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--9f739ece-a933-5cb0-a2b0-e8cf51d7d986", "toId": "11f41381-d95f-45ea-a338-cfa27d9fb2f8", "to_id": "11f41381-d95f-45ea-a338-cfa27d9fb2f8", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.862Z", "created_at": "2026-09-25T11:54:48.402Z", "modified": "2026-09-25T11:54:48.900Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:48.900Z" }, "description_available": false, "entity_type": "based-on", "fromId": "991685f9-2157-443c-a061-71dbcd5e6464", "from_id": "991685f9-2157-443c-a061-71dbcd5e6464", "from_name": null, "from_type": "Indicator", "id": "1b76b0f8-1b9a-48bc-a234-63c3f16812d2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--4a41050e-8500-5073-9f34-98a58b5d2b50", "toId": "c553810c-ad5a-42de-b87a-dd64bb427e41", "to_id": "c553810c-ad5a-42de-b87a-dd64bb427e41", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.280Z", "created_at": "2026-09-25T12:05:49.925Z", "modified": "2026-09-25T12:05:50.334Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:05:50.334Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d775665b-ce37-4a20-89bf-ac239e81206d", "from_id": "d775665b-ce37-4a20-89bf-ac239e81206d", "from_name": null, "from_type": "Indicator", "id": "1c721c90-95fc-4baa-be47-b179a8ff55ee", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--4f42fa5a-6e78-5d96-b4cf-3fbfab5ddc94", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.844Z", "created_at": "2026-09-25T11:54:45.097Z", "modified": "2026-09-25T11:54:46.780Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:46.780Z" }, "description_available": false, "entity_type": "based-on", "fromId": "41215419-0aec-4d9e-b644-164c3ae23d84", "from_id": "41215419-0aec-4d9e-b644-164c3ae23d84", "from_name": null, "from_type": "Indicator", "id": "1cbb5472-70e7-48ec-85b0-6f929356619d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--90c8c6d3-1705-56c7-b457-b4ac1f4bb2b5", "toId": "0643520a-ced4-4e0e-9185-3715a7bc2cab", "to_id": "0643520a-ced4-4e0e-9185-3715a7bc2cab", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.441Z", "created_at": "2026-09-25T12:09:34.652Z", "modified": "2026-09-25T12:09:34.819Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:09:34.819Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ae2832ba-bddc-4c16-86f3-1c9cd4b84b0a", "from_id": "ae2832ba-bddc-4c16-86f3-1c9cd4b84b0a", "from_name": null, "from_type": "Indicator", "id": "1e074d1d-66ab-4e10-9be4-e17e6da8181c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--c4ee977b-4c06-50ff-9f21-bf017244d9aa", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.195Z", "created_at": "2026-09-25T11:59:17.086Z", "modified": "2026-09-25T11:59:17.265Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:59:17.265Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3c0e91a6-24ec-4293-b3f3-fb81cb97b406", "from_id": "3c0e91a6-24ec-4293-b3f3-fb81cb97b406", "from_name": null, "from_type": "Indicator", "id": "22aa63d5-6fec-439e-a619-18918767ce8b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--4962d349-70c9-557a-8ff2-ef04736129e8", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.169Z", "created_at": "2026-09-25T11:58:51.377Z", "modified": "2026-09-25T11:58:51.801Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:58:51.801Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c3310886-218b-45d9-bc70-032b0ec0b693", "from_id": "c3310886-218b-45d9-bc70-032b0ec0b693", "from_name": null, "from_type": "Indicator", "id": "25246a9f-13e0-4170-b53d-5425f0782a58", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--0fc18c09-ba19-5414-9f1f-2eb03cc4a88f", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.469Z", "created_at": "2026-09-25T12:10:03.463Z", "modified": "2026-09-25T12:10:03.685Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:10:03.685Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8e3c2799-5d73-44fc-82fe-2eb228196f2b", "from_id": "8e3c2799-5d73-44fc-82fe-2eb228196f2b", "from_name": null, "from_type": "Indicator", "id": "2594fe6d-0789-464f-8ed0-c6f8749fce4d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--c310cc1c-da1d-564d-87ce-1f07e60d995e", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.926Z", "created_at": "2026-09-25T11:55:00.425Z", "modified": "2026-09-25T11:55:00.840Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:00.840Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9721ed52-bb84-4c69-85e7-694a66829f01", "from_id": "9721ed52-bb84-4c69-85e7-694a66829f01", "from_name": null, "from_type": "Indicator", "id": "270f7703-9df9-47ff-9701-8cb50792831b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--2c80c944-c5d6-58d1-b584-80f15baf2c97", "toId": "14cfd48b-331d-440b-8581-058737ad8037", "to_id": "14cfd48b-331d-440b-8581-058737ad8037", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.063Z", "created_at": "2026-09-25T11:57:19.668Z", "modified": "2026-09-25T11:57:19.935Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:57:19.935Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dfd780c5-f296-49ac-ac71-bcb02c73a5fb", "from_id": "dfd780c5-f296-49ac-ac71-bcb02c73a5fb", "from_name": null, "from_type": "Indicator", "id": "3300977e-3fbd-4812-b020-b6e10c0c141e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--6a239ea0-0c7c-5df1-bf7a-7b0f08115df3", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.347Z", "created_at": "2026-09-25T12:08:22.461Z", "modified": "2026-09-25T12:08:25.307Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:08:25.307Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aace7129-2520-4848-b85e-5a25a67c504d", "from_id": "aace7129-2520-4848-b85e-5a25a67c504d", "from_name": null, "from_type": "Indicator", "id": "337ecc08-01e0-418a-ad9b-2f9ba7f61f20", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--d933b26c-b2ce-5765-ae4c-356d7a790384", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.364Z", "created_at": "2026-09-25T12:08:41.737Z", "modified": "2026-09-25T12:08:42.033Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:08:42.033Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c978d5c5-874a-4994-aafb-baf0cfbc546c", "from_id": "c978d5c5-874a-4994-aafb-baf0cfbc546c", "from_name": null, "from_type": "Indicator", "id": "347206af-ec3e-404b-972c-c9a6aece6150", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--70d9a4de-60a2-59e9-bb17-c04300919bf7", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.050Z", "created_at": "2026-09-25T11:56:52.819Z", "modified": "2026-09-25T11:56:53.353Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:56:53.353Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6d0063b1-2b5b-4f43-8f51-3818e9a9a2be", "from_id": "6d0063b1-2b5b-4f43-8f51-3818e9a9a2be", "from_name": null, "from_type": "Indicator", "id": "372acd44-9088-4d87-b48f-14be00b383b6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--df862e74-5674-513f-98ed-658143af80a1", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.397Z", "created_at": "2026-09-25T12:09:07.167Z", "modified": "2026-09-25T12:09:07.596Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:09:07.596Z" }, "description_available": false, "entity_type": "indicates", "fromId": "560ba96f-13c9-4bcb-960b-6dfab539fb8a", "from_id": "560ba96f-13c9-4bcb-960b-6dfab539fb8a", "from_name": null, "from_type": "Indicator", "id": "382fae28-4874-4b7c-a86f-46abc07ec9cb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--708858dd-ae1e-5c69-b180-395267055750", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.259Z", "created_at": "2026-09-25T12:03:40.114Z", "modified": "2026-09-25T12:03:41.500Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:03:41.500Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cdb862f5-4342-4092-b1c9-cc4d537dd63d", "from_id": "cdb862f5-4342-4092-b1c9-cc4d537dd63d", "from_name": null, "from_type": "Indicator", "id": "39d00512-a043-483e-9fb0-6f30a507a5fb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--58ae29fb-e657-55ba-8fe0-5de9fbd038af", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.932Z", "created_at": "2026-09-25T11:55:00.914Z", "modified": "2026-09-25T11:55:01.377Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:01.377Z" }, "description_available": false, "entity_type": "based-on", "fromId": "aace7129-2520-4848-b85e-5a25a67c504d", "from_id": "aace7129-2520-4848-b85e-5a25a67c504d", "from_name": null, "from_type": "Indicator", "id": "3b448bbb-4710-408c-914b-93a36f686368", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--31fc31b4-b99d-5b04-8f7c-fe6b5578ddef", "toId": "2f70ef8a-e52b-4d8e-918e-713658c4b7c6", "to_id": "2f70ef8a-e52b-4d8e-918e-713658c4b7c6", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.929Z", "created_at": "2026-09-25T11:55:00.633Z", "modified": "2026-09-25T11:55:01.060Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:01.060Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9e2bc73a-d14e-46e2-a2f7-dc8561e12691", "from_id": "9e2bc73a-d14e-46e2-a2f7-dc8561e12691", "from_name": null, "from_type": "Indicator", "id": "3f354251-7b9d-4294-9dd9-754e50f0e080", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--6c33cb8b-7946-523d-bea2-b220de536768", "toId": "75bda196-60cc-4651-8621-816983bbfc37", "to_id": "75bda196-60cc-4651-8621-816983bbfc37", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.051Z", "created_at": "2026-09-25T11:56:54.047Z", "modified": "2026-09-25T11:56:54.356Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:56:54.356Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6d0063b1-2b5b-4f43-8f51-3818e9a9a2be", "from_id": "6d0063b1-2b5b-4f43-8f51-3818e9a9a2be", "from_name": null, "from_type": "Indicator", "id": "4028f5d3-9377-4142-92b0-af84987c7e7d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--249c2640-d201-5d8e-a925-3752b824fca1", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.495Z", "created_at": "2026-09-25T12:10:27.670Z", "modified": "2026-09-25T12:10:28.078Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:10:28.078Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dde6682e-e42d-4559-9608-572ef3162eb6", "from_id": "dde6682e-e42d-4559-9608-572ef3162eb6", "from_name": null, "from_type": "Indicator", "id": "448e1bed-cc1b-46f5-b468-810c2dc55e13", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--190856ac-3bc5-5b98-bb2d-6a6db1b168a3", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.281Z", "created_at": "2026-09-25T12:05:50.908Z", "modified": "2026-09-25T12:05:51.285Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:05:51.285Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d775665b-ce37-4a20-89bf-ac239e81206d", "from_id": "d775665b-ce37-4a20-89bf-ac239e81206d", "from_name": null, "from_type": "Indicator", "id": "44a1b088-bc64-493c-b07a-25859c63df7d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--857b2b7d-7449-5080-aeda-1e8304824a23", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.865Z", "created_at": "2026-09-25T11:54:49.272Z", "modified": "2026-09-25T11:54:49.686Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:49.686Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a4bd22c2-eb04-48d5-9f15-1dceadbb688d", "from_id": "a4bd22c2-eb04-48d5-9f15-1dceadbb688d", "from_name": null, "from_type": "Indicator", "id": "44b8cd67-80d8-4816-b743-eb7de7f72d0f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--91fe2a9a-613c-5b76-a236-905a96ba9fe8", "toId": "8dce0d37-1027-4edc-b0eb-a6caea2879d8", "to_id": "8dce0d37-1027-4edc-b0eb-a6caea2879d8", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.223Z", "created_at": "2026-09-25T12:01:52.993Z", "modified": "2026-09-25T12:01:57.718Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:01:57.718Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1772709a-daec-447f-8e9d-75dc3c2c5b7e", "from_id": "1772709a-daec-447f-8e9d-75dc3c2c5b7e", "from_name": null, "from_type": "Indicator", "id": "459c0c62-caae-4ec1-9f94-e6815ab72158", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--ca8131cc-9d99-5cef-b017-549fd4ff309a", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.235Z", "created_at": "2026-09-25T12:02:37.203Z", "modified": "2026-09-25T12:02:37.915Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:02:37.915Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f2bb45a8-55e9-473a-8289-abb916ab5b5e", "from_id": "f2bb45a8-55e9-473a-8289-abb916ab5b5e", "from_name": null, "from_type": "Indicator", "id": "47f397f7-ef39-4be6-a0b8-a76c3a52d421", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--9ef6add6-aadd-5dee-8e29-8c47d8119fdc", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.074Z", "created_at": "2026-09-25T11:57:22.286Z", "modified": "2026-09-25T11:57:22.434Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:57:22.434Z" }, "description_available": false, "entity_type": "indicates", "fromId": "75943aae-80ff-42fb-aa8d-66545e137b5e", "from_id": "75943aae-80ff-42fb-aa8d-66545e137b5e", "from_name": null, "from_type": "Indicator", "id": "4b201b1d-9136-4427-b17e-8861c8147d07", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--4a477dcb-a738-59a2-8207-ed69010620bb", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.886Z", "created_at": "2026-09-25T11:54:52.811Z", "modified": "2026-09-25T11:54:53.494Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:53.494Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c3310886-218b-45d9-bc70-032b0ec0b693", "from_id": "c3310886-218b-45d9-bc70-032b0ec0b693", "from_name": null, "from_type": "Indicator", "id": "4c87cd15-da18-42e8-a4bb-3f4797bc77f4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--49b964c1-55b0-5aa2-98cb-009a52e3578b", "toId": "c5b4d0cb-f102-49f0-8421-97e33fb26b03", "to_id": "c5b4d0cb-f102-49f0-8421-97e33fb26b03", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.909Z", "created_at": "2026-09-25T11:54:55.320Z", "modified": "2026-09-25T11:54:58.350Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:58.350Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c6c50dcc-b0c4-47d9-a28a-42fa5812f363", "from_id": "c6c50dcc-b0c4-47d9-a28a-42fa5812f363", "from_name": null, "from_type": "Indicator", "id": "4e69b923-9e51-4d4a-8f5b-8e3fb67bb178", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--cdabe2d7-bfcf-57bb-81e5-fd3f0b3645b9", "toId": "405c868f-69a3-4000-b890-78fb7c22e7bd", "to_id": "405c868f-69a3-4000-b890-78fb7c22e7bd", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.148Z", "created_at": "2026-09-25T11:58:31.308Z", "modified": "2026-09-25T11:58:32.153Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:58:32.153Z" }, "description_available": false, "entity_type": "indicates", "fromId": "add851a1-8632-4f9a-ae8a-51220e541239", "from_id": "add851a1-8632-4f9a-ae8a-51220e541239", "from_name": null, "from_type": "Indicator", "id": "4ed900f4-0259-4b2c-a8cd-a217192f0d27", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--43b3419d-3fe8-550f-9544-abcc445c4483", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.102Z", "created_at": "2026-09-25T11:57:49.172Z", "modified": "2026-09-25T11:57:50.089Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:57:50.089Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a4bd22c2-eb04-48d5-9f15-1dceadbb688d", "from_id": "a4bd22c2-eb04-48d5-9f15-1dceadbb688d", "from_name": null, "from_type": "Indicator", "id": "5130f241-5647-490e-81ef-d69091ecb728", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--f37d6750-d64e-5b9b-ae8b-9f0e8f55fd3a", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.323Z", "created_at": "2026-09-25T12:06:55.785Z", "modified": "2026-09-25T12:06:56.163Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:06:56.163Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9721ed52-bb84-4c69-85e7-694a66829f01", "from_id": "9721ed52-bb84-4c69-85e7-694a66829f01", "from_name": null, "from_type": "Indicator", "id": "52eb5c9f-0cb6-448e-ba0a-5e817530c585", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--2a08270f-f1c1-5fda-b855-6480b5bb8339", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.873Z", "created_at": "2026-09-25T11:54:49.535Z", "modified": "2026-09-25T11:54:51.942Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:51.942Z" }, "description_available": false, "entity_type": "based-on", "fromId": "58dc0886-3aa4-49c4-b463-59d8ac72cae9", "from_id": "58dc0886-3aa4-49c4-b463-59d8ac72cae9", "from_name": null, "from_type": "Indicator", "id": "5903f825-0a01-4f96-86cb-90e916071fa4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--1992eee4-cea3-51af-8517-0b04526668cc", "toId": "6bf31ff2-35f3-4e3a-a3b7-b6ace11b7df2", "to_id": "6bf31ff2-35f3-4e3a-a3b7-b6ace11b7df2", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.259Z", "created_at": "2026-09-25T12:03:43.138Z", "modified": "2026-09-25T12:03:46.126Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:03:46.126Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cdb862f5-4342-4092-b1c9-cc4d537dd63d", "from_id": "cdb862f5-4342-4092-b1c9-cc4d537dd63d", "from_name": null, "from_type": "Indicator", "id": "5a31f037-02c0-4b79-87cd-c9b2d219f1b9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--e44181cf-6403-5780-ba3e-23c66a2cf8c5", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.495Z", "created_at": "2026-09-25T12:10:27.063Z", "modified": "2026-09-25T12:10:27.295Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:10:27.295Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dde6682e-e42d-4559-9608-572ef3162eb6", "from_id": "dde6682e-e42d-4559-9608-572ef3162eb6", "from_name": null, "from_type": "Indicator", "id": "612b005b-dd91-4de6-b458-f9c360017aa1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--5afc2022-fc2b-5250-97cf-e39f3f3fb12c", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.483Z", "created_at": "2026-09-25T12:10:25.012Z", "modified": "2026-09-25T12:10:25.110Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:10:25.110Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a2c30c66-ab6e-44c7-b7e9-2b8bdb2b9952", "from_id": "a2c30c66-ab6e-44c7-b7e9-2b8bdb2b9952", "from_name": null, "from_type": "Indicator", "id": "61709105-6794-4766-8aac-c1b38f8d1ba8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--d10f37be-1bf8-5c87-9c22-8c29c0581306", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.999Z", "created_at": "2026-09-25T11:55:58.742Z", "modified": "2026-09-25T11:55:59.536Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:59.536Z" }, "description_available": false, "entity_type": "indicates", "fromId": "234a9ea3-c046-4ae1-9f1e-e0b7a76073a3", "from_id": "234a9ea3-c046-4ae1-9f1e-e0b7a76073a3", "from_name": null, "from_type": "Indicator", "id": "61a3c975-f257-4eed-963d-44037a1affe5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--de9dd1d8-7005-5a90-9b41-110fbdf312ce", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.134Z", "created_at": "2026-09-25T11:58:24.107Z", "modified": "2026-09-25T11:58:24.213Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:58:24.213Z" }, "description_available": false, "entity_type": "indicates", "fromId": "58dc0886-3aa4-49c4-b463-59d8ac72cae9", "from_id": "58dc0886-3aa4-49c4-b463-59d8ac72cae9", "from_name": null, "from_type": "Indicator", "id": "634fd0bc-3116-4815-be9d-2ed446663215", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--a60603dc-2bb8-593a-bc40-2189dc3d675d", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.011Z", "created_at": "2026-09-25T11:56:10.941Z", "modified": "2026-09-25T11:56:11.121Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:56:11.121Z" }, "description_available": false, "entity_type": "indicates", "fromId": "41215419-0aec-4d9e-b644-164c3ae23d84", "from_id": "41215419-0aec-4d9e-b644-164c3ae23d84", "from_name": null, "from_type": "Indicator", "id": "64ffddb9-41f3-4fd2-9349-93432df8c869", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--07066f95-3fb1-57e7-bcc5-aa2f57472c53", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.853Z", "created_at": "2026-09-25T11:54:47.204Z", "modified": "2026-09-25T11:54:47.792Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:47.792Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6d0063b1-2b5b-4f43-8f51-3818e9a9a2be", "from_id": "6d0063b1-2b5b-4f43-8f51-3818e9a9a2be", "from_name": null, "from_type": "Indicator", "id": "68ccc941-616f-4f02-b3e4-5663661ffe42", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--d6e0f1ba-c805-5dd4-b3ee-f0e8d2f937d6", "toId": "525370a3-5324-4043-b163-d2f87a227112", "to_id": "525370a3-5324-4043-b163-d2f87a227112", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.247Z", "created_at": "2026-09-25T12:03:01.746Z", "modified": "2026-09-25T12:03:02.786Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:03:02.786Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c6c50dcc-b0c4-47d9-a28a-42fa5812f363", "from_id": "c6c50dcc-b0c4-47d9-a28a-42fa5812f363", "from_name": null, "from_type": "Indicator", "id": "6a6226be-4109-496b-8841-df5f9ab3b81f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--f3270317-6f72-5388-add8-9d1add0e365a", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.934Z", "created_at": "2026-09-25T11:55:01.446Z", "modified": "2026-09-25T11:55:02.552Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:02.552Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c978d5c5-874a-4994-aafb-baf0cfbc546c", "from_id": "c978d5c5-874a-4994-aafb-baf0cfbc546c", "from_name": null, "from_type": "Indicator", "id": "6b91722e-1963-454b-9bf6-0cd639fe1d8b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--94e75557-0df7-56f1-881e-09f03780dafa", "toId": "b131436d-65d7-403e-8cb3-6964a265bf65", "to_id": "b131436d-65d7-403e-8cb3-6964a265bf65", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.903Z", "created_at": "2026-09-25T11:54:54.386Z", "modified": "2026-09-25T11:54:54.922Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:54.922Z" }, "description_available": false, "entity_type": "based-on", "fromId": "1772709a-daec-447f-8e9d-75dc3c2c5b7e", "from_id": "1772709a-daec-447f-8e9d-75dc3c2c5b7e", "from_name": null, "from_type": "Indicator", "id": "6d6ce96c-067c-4760-a576-f08f96329628", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--5066855e-fdc1-5e4f-a997-a09d7eefef38", "toId": "39e6a339-988a-4f54-89c8-4ed04fbec74a", "to_id": "39e6a339-988a-4f54-89c8-4ed04fbec74a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.877Z", "created_at": "2026-09-25T11:54:52.332Z", "modified": "2026-09-25T11:54:52.825Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:52.825Z" }, "description_available": false, "entity_type": "based-on", "fromId": "add851a1-8632-4f9a-ae8a-51220e541239", "from_id": "add851a1-8632-4f9a-ae8a-51220e541239", "from_name": null, "from_type": "Indicator", "id": "729d2595-ef8b-48ee-97e4-675e89eeebe5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--cde2f268-7356-52ae-a701-1c060efb0c5d", "toId": "06604e94-acb3-493b-a41a-6d46a3b0a1ae", "to_id": "06604e94-acb3-493b-a41a-6d46a3b0a1ae", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.292Z", "created_at": "2026-09-25T12:06:22.031Z", "modified": "2026-09-25T12:06:23.915Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:06:23.915Z" }, "description_available": false, "entity_type": "indicates", "fromId": "88511034-5c64-443a-9d7b-80930844bff3", "from_id": "88511034-5c64-443a-9d7b-80930844bff3", "from_name": null, "from_type": "Indicator", "id": "76ecfb57-97f3-440f-8238-7f56d2c75ccd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--b15be26f-d623-52d3-909c-3b8e3e04b5d7", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.455Z", "created_at": "2026-09-25T12:09:49.500Z", "modified": "2026-09-25T12:09:49.748Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:09:49.748Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d72fea1f-55d7-417a-99e7-f1978950ed30", "from_id": "d72fea1f-55d7-417a-99e7-f1978950ed30", "from_name": null, "from_type": "Indicator", "id": "7a61eea9-51ef-4f22-a803-ab9fd47e5094", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--4bdc653c-878b-5a8c-9e88-157ae4500a77", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.973Z", "created_at": "2026-09-25T11:55:31.384Z", "modified": "2026-09-25T11:55:31.596Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:31.596Z" }, "description_available": false, "entity_type": "indicates", "fromId": "37aa4704-03f7-42da-ae3a-82dc2766e422", "from_id": "37aa4704-03f7-42da-ae3a-82dc2766e422", "from_name": null, "from_type": "Indicator", "id": "890f3853-b3e3-44a5-9aaf-2a530987a845", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--a1234697-9d1c-5ec6-a787-43fa4c3bc210", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.086Z", "created_at": "2026-09-25T11:57:33.739Z", "modified": "2026-09-25T11:57:34.046Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:57:34.046Z" }, "description_available": false, "entity_type": "indicates", "fromId": "991685f9-2157-443c-a061-71dbcd5e6464", "from_id": "991685f9-2157-443c-a061-71dbcd5e6464", "from_name": null, "from_type": "Indicator", "id": "896e9f78-644e-4233-bc7f-810cf20c55fb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--9ab18cdc-ec1a-5be2-b093-74a0a0aab6c2", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.973Z", "created_at": "2026-09-25T11:55:23.068Z", "modified": "2026-09-25T11:55:23.503Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:23.503Z" }, "description_available": false, "entity_type": "indicates", "fromId": "37aa4704-03f7-42da-ae3a-82dc2766e422", "from_id": "37aa4704-03f7-42da-ae3a-82dc2766e422", "from_name": null, "from_type": "Indicator", "id": "8bf0fa53-d722-4664-b9c9-7ac1e8acfdda", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--dbc7c0bd-1528-5f5a-a684-88793e5cf047", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.169Z", "created_at": "2026-09-25T11:58:49.854Z", "modified": "2026-09-25T11:58:51.117Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:58:51.117Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c3310886-218b-45d9-bc70-032b0ec0b693", "from_id": "c3310886-218b-45d9-bc70-032b0ec0b693", "from_name": null, "from_type": "Indicator", "id": "8cfcb440-b8fa-4e02-83c6-0eaeb168d132", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--a000b7c3-d3cb-5362-9e6c-28421716675f", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.026Z", "created_at": "2026-09-25T11:56:22.803Z", "modified": "2026-09-25T11:56:23.112Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:56:23.112Z" }, "description_available": false, "entity_type": "indicates", "fromId": "53901640-201f-481f-9d1b-cac560beffa4", "from_id": "53901640-201f-481f-9d1b-cac560beffa4", "from_name": null, "from_type": "Indicator", "id": "8eae4ca1-10e5-40ed-8ab0-5d324bc5a8c4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--273e9a48-93e1-5a95-b76a-eb4507188b90", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.322Z", "created_at": "2026-09-25T12:06:55.049Z", "modified": "2026-09-25T12:06:55.321Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:06:55.321Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9721ed52-bb84-4c69-85e7-694a66829f01", "from_id": "9721ed52-bb84-4c69-85e7-694a66829f01", "from_name": null, "from_type": "Indicator", "id": "9049384f-db83-445c-a5fa-7d1f6685e01b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--33a83f2e-57d7-5026-a0a8-873ada08d581", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.147Z", "created_at": "2026-09-25T11:58:24.133Z", "modified": "2026-09-25T11:58:24.422Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:58:24.422Z" }, "description_available": false, "entity_type": "indicates", "fromId": "add851a1-8632-4f9a-ae8a-51220e541239", "from_id": "add851a1-8632-4f9a-ae8a-51220e541239", "from_name": null, "from_type": "Indicator", "id": "9106cd8b-f0c5-41d3-adea-6edb2c062f79", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--5e8dec45-07c8-5c41-9624-9877cbeb1098", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.857Z", "created_at": "2026-09-25T11:54:48.127Z", "modified": "2026-09-25T11:54:48.537Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:48.537Z" }, "description_available": false, "entity_type": "based-on", "fromId": "dfd780c5-f296-49ac-ac71-bcb02c73a5fb", "from_id": "dfd780c5-f296-49ac-ac71-bcb02c73a5fb", "from_name": null, "from_type": "Indicator", "id": "95369106-bf3e-4877-aebb-068256217d0c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--78eacb47-e047-5720-93ce-9ae163e29729", "toId": "8748c44d-fa7b-4aea-a0bd-21c5b3f2f2f2", "to_id": "8748c44d-fa7b-4aea-a0bd-21c5b3f2f2f2", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.381Z", "created_at": "2026-09-25T12:08:53.445Z", "modified": "2026-09-25T12:08:53.769Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:08:53.769Z" }, "description_available": false, "entity_type": "indicates", "fromId": "088c5012-ddcb-4c76-8bbb-aaa384ecebbc", "from_id": "088c5012-ddcb-4c76-8bbb-aaa384ecebbc", "from_name": null, "from_type": "Indicator", "id": "96a5506e-4370-4fed-8c2b-6e14d8d00f80", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--68eda2ac-be2c-59f2-9e4c-8dd979c1a4c2", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.961Z", "created_at": "2026-09-25T11:55:05.431Z", "modified": "2026-09-25T11:55:05.898Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:05.898Z" }, "description_available": false, "entity_type": "based-on", "fromId": "dde6682e-e42d-4559-9608-572ef3162eb6", "from_id": "dde6682e-e42d-4559-9608-572ef3162eb6", "from_name": null, "from_type": "Indicator", "id": "96ff9681-eaa7-4b8e-a732-e79fab04f362", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--fbdfb57e-952c-5b12-9635-87ceb6644eb2", "toId": "84435134-e86f-42f2-8cd9-543dc745f3e2", "to_id": "84435134-e86f-42f2-8cd9-543dc745f3e2", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.039Z", "created_at": "2026-09-25T11:56:37.146Z", "modified": "2026-09-25T11:56:39.285Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:56:39.285Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65641956-bff9-4e27-b299-bf435f691e17", "from_id": "65641956-bff9-4e27-b299-bf435f691e17", "from_name": null, "from_type": "Indicator", "id": "974076f3-6b24-42f0-9727-4dae8f5872a9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--6b49cdc1-3b73-5e01-9e5f-5db30ebff137", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.025Z", "created_at": "2026-09-25T11:56:21.974Z", "modified": "2026-09-25T11:56:22.258Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:56:22.258Z" }, "description_available": false, "entity_type": "indicates", "fromId": "53901640-201f-481f-9d1b-cac560beffa4", "from_id": "53901640-201f-481f-9d1b-cac560beffa4", "from_name": null, "from_type": "Indicator", "id": "9764aeca-be3d-4010-87ba-49a1673f9861", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--6b97d1b5-0ac1-57f9-bf63-5789268b2f64", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.850Z", "created_at": "2026-09-25T11:54:45.828Z", "modified": "2026-09-25T11:54:47.793Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:47.793Z" }, "description_available": false, "entity_type": "based-on", "fromId": "65641956-bff9-4e27-b299-bf435f691e17", "from_id": "65641956-bff9-4e27-b299-bf435f691e17", "from_name": null, "from_type": "Indicator", "id": "a0a53c3d-dc67-4d75-81e4-c94d79c3e9cd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--95243161-fce8-5374-ac9b-3e95bd949bf1", "toId": "42d26cd1-6154-42e5-bbfb-bf77c7608035", "to_id": "42d26cd1-6154-42e5-bbfb-bf77c7608035", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.380Z", "created_at": "2026-09-25T12:08:51.623Z", "modified": "2026-09-25T12:08:51.823Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:08:51.823Z" }, "description_available": false, "entity_type": "indicates", "fromId": "088c5012-ddcb-4c76-8bbb-aaa384ecebbc", "from_id": "088c5012-ddcb-4c76-8bbb-aaa384ecebbc", "from_name": null, "from_type": "Indicator", "id": "a1e6a536-45d8-400e-a056-2f0d9baf2d7d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--27f38e62-3ac3-57c2-87d3-8955a2f73ea0", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.133Z", "created_at": "2026-09-25T11:58:14.042Z", "modified": "2026-09-25T11:58:15.254Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:58:15.254Z" }, "description_available": false, "entity_type": "indicates", "fromId": "58dc0886-3aa4-49c4-b463-59d8ac72cae9", "from_id": "58dc0886-3aa4-49c4-b463-59d8ac72cae9", "from_name": null, "from_type": "Indicator", "id": "a301c11e-819c-44f7-b120-0580569fe4cb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--336b94ef-d3f2-5251-b54c-647c7798f628", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.962Z", "created_at": "2026-09-25T11:55:14.184Z", "modified": "2026-09-25T11:55:15.511Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:15.511Z" }, "description_available": false, "entity_type": "indicates", "fromId": "13c168da-e080-4318-a177-29370ad6ae75", "from_id": "13c168da-e080-4318-a177-29370ad6ae75", "from_name": null, "from_type": "Indicator", "id": "a3a7c9f9-39c5-4a20-944e-b221fe341038", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--c4c18019-a85c-52a4-af2e-0810f642d22e", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.921Z", "created_at": "2026-09-25T11:54:59.609Z", "modified": "2026-09-25T11:54:59.986Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:59.986Z" }, "description_available": false, "entity_type": "based-on", "fromId": "88511034-5c64-443a-9d7b-80930844bff3", "from_id": "88511034-5c64-443a-9d7b-80930844bff3", "from_name": null, "from_type": "Indicator", "id": "a71ad5f2-ff87-47d5-8fd4-d41036c047a8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--7119581a-8978-5c90-bf3d-0d87fe1c9af7", "toId": "0f0568c0-f9ae-4241-b891-e68302101329", "to_id": "0f0568c0-f9ae-4241-b891-e68302101329", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.158Z", "created_at": "2026-09-25T11:58:35.769Z", "modified": "2026-09-25T11:58:36.416Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:58:36.416Z" }, "description_available": false, "entity_type": "indicates", "fromId": "727b88a4-91e7-4208-8159-31e696bc23f2", "from_id": "727b88a4-91e7-4208-8159-31e696bc23f2", "from_name": null, "from_type": "Indicator", "id": "a7739fad-db77-400a-94f8-bedada05c4df", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--a2e537dd-9778-5b5d-b2f8-b44647670874", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.835Z", "created_at": "2026-09-25T11:54:40.731Z", "modified": "2026-09-25T11:54:41.651Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:41.651Z" }, "description_available": false, "entity_type": "based-on", "fromId": "37aa4704-03f7-42da-ae3a-82dc2766e422", "from_id": "37aa4704-03f7-42da-ae3a-82dc2766e422", "from_name": null, "from_type": "Indicator", "id": "a7fec617-bee3-49dc-bd1d-8857c3ae71c8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--379e5ab2-9518-5cae-97d6-461308a86208", "toId": "f627b03b-c9e7-4fcc-b282-404d03a6c541", "to_id": "f627b03b-c9e7-4fcc-b282-404d03a6c541", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.236Z", "created_at": "2026-09-25T12:02:45.466Z", "modified": "2026-09-25T12:02:46.142Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:02:46.142Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f2bb45a8-55e9-473a-8289-abb916ab5b5e", "from_id": "f2bb45a8-55e9-473a-8289-abb916ab5b5e", "from_name": null, "from_type": "Indicator", "id": "aaca6c4e-1be8-4fcb-b844-6d2631a5ae8d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--e94e9964-2e4e-519b-a87a-88659f229400", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.442Z", "created_at": "2026-09-25T12:09:35.298Z", "modified": "2026-09-25T12:09:35.509Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:09:35.509Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ae2832ba-bddc-4c16-86f3-1c9cd4b84b0a", "from_id": "ae2832ba-bddc-4c16-86f3-1c9cd4b84b0a", "from_name": null, "from_type": "Indicator", "id": "ad5368f5-6854-4ca4-ac7b-ca59d302d4fa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--061baae7-5522-5e32-942c-4c7a192601e5", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.988Z", "created_at": "2026-09-25T11:55:49.062Z", "modified": "2026-09-25T11:55:49.508Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:49.508Z" }, "description_available": false, "entity_type": "indicates", "fromId": "734b916d-dd15-49cc-9a97-484b387c9dc8", "from_id": "734b916d-dd15-49cc-9a97-484b387c9dc8", "from_name": null, "from_type": "Indicator", "id": "ad9b7be6-c40d-4d08-a03c-25726b1a95b1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--0f7a6889-bb09-575f-9224-30150367029f", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.924Z", "created_at": "2026-09-25T11:54:59.944Z", "modified": "2026-09-25T11:55:00.360Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:00.360Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9127dee6-f591-4bdd-b5b6-47d72e9fa3d8", "from_id": "9127dee6-f591-4bdd-b5b6-47d72e9fa3d8", "from_name": null, "from_type": "Indicator", "id": "ae66c3dd-553d-4c7b-ad33-ce08255ba9e8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--d6296124-ed2c-5855-a474-0775692959a8", "toId": "74f75ec4-6d41-4690-a1c2-ff913ccbc6bf", "to_id": "74f75ec4-6d41-4690-a1c2-ff913ccbc6bf", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.038Z", "created_at": "2026-09-25T11:56:36.394Z", "modified": "2026-09-25T11:56:36.592Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:56:36.592Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65641956-bff9-4e27-b299-bf435f691e17", "from_id": "65641956-bff9-4e27-b299-bf435f691e17", "from_name": null, "from_type": "Indicator", "id": "b38b3f09-3845-4c27-a8f2-f031751bf410", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--a6f37cdf-6978-5255-809e-f05e3cfbf614", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.962Z", "created_at": "2026-09-25T11:55:05.995Z", "modified": "2026-09-25T11:55:06.393Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:06.393Z" }, "description_available": false, "entity_type": "indicates", "fromId": "13c168da-e080-4318-a177-29370ad6ae75", "from_id": "13c168da-e080-4318-a177-29370ad6ae75", "from_name": null, "from_type": "Indicator", "id": "b52bad7d-8a9a-4158-a19b-a5c73327d1b9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--7d735d38-ff37-5d27-a37c-3b99623c8dae", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.363Z", "created_at": "2026-09-25T12:08:40.211Z", "modified": "2026-09-25T12:08:41.419Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:08:41.419Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c978d5c5-874a-4994-aafb-baf0cfbc546c", "from_id": "c978d5c5-874a-4994-aafb-baf0cfbc546c", "from_name": null, "from_type": "Indicator", "id": "b85364f7-1296-47ae-b4ec-b3a8003b1095", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--c0c6660a-fa03-5192-907e-70f65d8cb159", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.918Z", "created_at": "2026-09-25T11:54:59.098Z", "modified": "2026-09-25T11:54:59.521Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:59.521Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d775665b-ce37-4a20-89bf-ac239e81206d", "from_id": "d775665b-ce37-4a20-89bf-ac239e81206d", "from_name": null, "from_type": "Indicator", "id": "b975bdb6-78f1-4aae-a0e0-eb8121a4bdcc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--1892de3f-c90b-52a3-932e-0180ed216cdd", "toId": "b4907ef6-d3df-4fac-94ef-95caa0f83cf4", "to_id": "b4907ef6-d3df-4fac-94ef-95caa0f83cf4", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.248Z", "created_at": "2026-09-25T12:03:03.445Z", "modified": "2026-09-25T12:03:03.906Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:03:03.906Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c6c50dcc-b0c4-47d9-a28a-42fa5812f363", "from_id": "c6c50dcc-b0c4-47d9-a28a-42fa5812f363", "from_name": null, "from_type": "Indicator", "id": "bb47b495-13d5-4e92-a52b-d22408bbc427", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--e1a38f47-46d9-5abf-963b-cf2f37f76f93", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.270Z", "created_at": "2026-09-25T12:05:27.567Z", "modified": "2026-09-25T12:05:27.874Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:05:27.874Z" }, "description_available": false, "entity_type": "indicates", "fromId": "619faf2c-6b63-4018-b17c-8252061a1863", "from_id": "619faf2c-6b63-4018-b17c-8252061a1863", "from_name": null, "from_type": "Indicator", "id": "bc733a25-3d4c-4ee2-bc8d-68f3be5a8e60", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--18b369e4-7b96-57e0-b847-36da6b7516ed", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.833Z", "created_at": "2026-09-25T11:54:40.528Z", "modified": "2026-09-25T11:54:41.028Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:41.028Z" }, "description_available": false, "entity_type": "based-on", "fromId": "13c168da-e080-4318-a177-29370ad6ae75", "from_id": "13c168da-e080-4318-a177-29370ad6ae75", "from_name": null, "from_type": "Indicator", "id": "bd50f1cf-10eb-46fc-9d4a-185ccfec372c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--21cf204c-650f-56af-80b6-850e7dd30172", "toId": "84fb7845-8474-4b0a-902d-864a3d09a81d", "to_id": "84fb7845-8474-4b0a-902d-864a3d09a81d", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.469Z", "created_at": "2026-09-25T12:10:04.043Z", "modified": "2026-09-25T12:10:04.432Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:10:04.432Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8e3c2799-5d73-44fc-82fe-2eb228196f2b", "from_id": "8e3c2799-5d73-44fc-82fe-2eb228196f2b", "from_name": null, "from_type": "Indicator", "id": "c178c711-3690-448e-9171-0f980b6d9025", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--bd4a1c8a-9ffb-5b55-bcdc-e0dda07266b8", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.291Z", "created_at": "2026-09-25T12:06:15.801Z", "modified": "2026-09-25T12:06:17.562Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:06:17.562Z" }, "description_available": false, "entity_type": "indicates", "fromId": "88511034-5c64-443a-9d7b-80930844bff3", "from_id": "88511034-5c64-443a-9d7b-80930844bff3", "from_name": null, "from_type": "Indicator", "id": "c22a19df-78dc-47ad-9e12-21f9908ab587", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--8972cacd-5ba4-5313-9b2e-b0ec1044831d", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.420Z", "created_at": "2026-09-25T12:09:20.212Z", "modified": "2026-09-25T12:09:20.400Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:09:20.400Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a0f18bcc-902d-4beb-a755-3c962dd9287b", "from_id": "a0f18bcc-902d-4beb-a755-3c962dd9287b", "from_name": null, "from_type": "Indicator", "id": "c3051991-b114-4897-bf4c-b52953e56954", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--3ad44b6f-718a-500c-9882-fcf0049ceb3a", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.868Z", "created_at": "2026-09-25T11:54:49.531Z", "modified": "2026-09-25T11:54:51.941Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:51.941Z" }, "description_available": false, "entity_type": "based-on", "fromId": "837458c2-5235-4325-afee-a00f4d014b7d", "from_id": "837458c2-5235-4325-afee-a00f4d014b7d", "from_name": null, "from_type": "Indicator", "id": "c32ae5e9-69cb-4f9f-b816-ad42d6c8781a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--a0ec7cf6-1578-56ee-ac19-00c2a77b0900", "toId": "b9ffc425-5be9-4c77-affd-095f595995a1", "to_id": "b9ffc425-5be9-4c77-affd-095f595995a1", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.333Z", "created_at": "2026-09-25T12:07:11.842Z", "modified": "2026-09-25T12:07:12.233Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:07:12.233Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9e2bc73a-d14e-46e2-a2f7-dc8561e12691", "from_id": "9e2bc73a-d14e-46e2-a2f7-dc8561e12691", "from_name": null, "from_type": "Indicator", "id": "c3be3c88-b35c-4119-b0e5-aeeacea43c5d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--2b16c63b-c3ef-535a-8f9c-fb50318360ee", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.306Z", "created_at": "2026-09-25T12:06:41.184Z", "modified": "2026-09-25T12:06:41.732Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:06:41.732Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9127dee6-f591-4bdd-b5b6-47d72e9fa3d8", "from_id": "9127dee6-f591-4bdd-b5b6-47d72e9fa3d8", "from_name": null, "from_type": "Indicator", "id": "c415a015-30fd-48a8-a388-7562b28ad2ed", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--de803b85-265f-5f26-9e69-80a5f655e0dd", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.397Z", "created_at": "2026-09-25T12:09:06.374Z", "modified": "2026-09-25T12:09:06.587Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:09:06.587Z" }, "description_available": false, "entity_type": "indicates", "fromId": "560ba96f-13c9-4bcb-960b-6dfab539fb8a", "from_id": "560ba96f-13c9-4bcb-960b-6dfab539fb8a", "from_name": null, "from_type": "Indicator", "id": "c5a60181-50a4-42a6-84a9-794e813ad638", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--bcd1a26f-9560-55f1-a031-ab04fdcc8fb7", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.158Z", "created_at": "2026-09-25T11:58:39.740Z", "modified": "2026-09-25T11:58:40.083Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:58:40.083Z" }, "description_available": false, "entity_type": "indicates", "fromId": "727b88a4-91e7-4208-8159-31e696bc23f2", "from_id": "727b88a4-91e7-4208-8159-31e696bc23f2", "from_name": null, "from_type": "Indicator", "id": "c829092e-c300-4600-8ed4-0df1d41a8aad", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--79ffec91-30f1-54c7-8e19-23268155877a", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.937Z", "created_at": "2026-09-25T11:55:02.472Z", "modified": "2026-09-25T11:55:02.777Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:02.777Z" }, "description_available": false, "entity_type": "based-on", "fromId": "088c5012-ddcb-4c76-8bbb-aaa384ecebbc", "from_id": "088c5012-ddcb-4c76-8bbb-aaa384ecebbc", "from_name": null, "from_type": "Indicator", "id": "ca1a8a43-a599-4baf-9b4f-2613444438fc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--e5bf91ae-6aeb-5cc6-9953-4095904a1eac", "toId": "d576c37a-8763-4066-a1e8-a6d792526fc5", "to_id": "d576c37a-8763-4066-a1e8-a6d792526fc5", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.793Z", "created_at": "2026-09-25T11:53:08.170Z", "modified": "2026-09-25T11:53:11.185Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:53:11.185Z" }, "description_available": false, "entity_type": "uses", "fromId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_name": "DPRK", "from_type": "IntrusionSet", "id": "cad7a501-80f1-4440-87fa-bb5993338bb7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--3943645c-6cc3-5a05-ac13-8706f92a278b", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.912Z", "created_at": "2026-09-25T11:54:56.064Z", "modified": "2026-09-25T11:54:58.576Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:58.576Z" }, "description_available": false, "entity_type": "based-on", "fromId": "cdb862f5-4342-4092-b1c9-cc4d537dd63d", "from_id": "cdb862f5-4342-4092-b1c9-cc4d537dd63d", "from_name": null, "from_type": "Indicator", "id": "cb42790d-4250-4a16-84ea-ff1764ac984e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--decf4898-6336-5a51-b7c8-a1d8eac02d59", "toId": "c59e4b72-37d4-472b-bef4-6bca94deb827", "to_id": "c59e4b72-37d4-472b-bef4-6bca94deb827", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.859Z", "created_at": "2026-09-25T11:54:48.423Z", "modified": "2026-09-25T11:54:48.901Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:48.901Z" }, "description_available": false, "entity_type": "based-on", "fromId": "75943aae-80ff-42fb-aa8d-66545e137b5e", "from_id": "75943aae-80ff-42fb-aa8d-66545e137b5e", "from_name": null, "from_type": "Indicator", "id": "cc0c9d87-904c-4fde-951f-9250ffb1c475", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--a95f21cc-a24a-5a2b-90f0-cf6d571c7a7c", "toId": "308af10a-5a6f-4cc0-ad83-1e437c079166", "to_id": "308af10a-5a6f-4cc0-ad83-1e437c079166", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.196Z", "created_at": "2026-09-25T11:59:17.476Z", "modified": "2026-09-25T11:59:19.001Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:59:19.001Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3c0e91a6-24ec-4293-b3f3-fb81cb97b406", "from_id": "3c0e91a6-24ec-4293-b3f3-fb81cb97b406", "from_name": null, "from_type": "Indicator", "id": "cf78a5ae-556f-4b99-944e-c13121449f91", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--63ee80e8-5f8c-58a5-a1d6-4b8bf1b6351e", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.988Z", "created_at": "2026-09-25T11:55:44.307Z", "modified": "2026-09-25T11:55:44.650Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:44.650Z" }, "description_available": false, "entity_type": "indicates", "fromId": "734b916d-dd15-49cc-9a97-484b387c9dc8", "from_id": "734b916d-dd15-49cc-9a97-484b387c9dc8", "from_name": null, "from_type": "Indicator", "id": "cfd58a08-8934-4a5b-b30b-7fee73e49435", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--7fd05b6c-8ba8-5537-8ea0-4d0b2f93c6c4", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.955Z", "created_at": "2026-09-25T11:55:04.449Z", "modified": "2026-09-25T11:55:05.368Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:05.368Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8e3c2799-5d73-44fc-82fe-2eb228196f2b", "from_id": "8e3c2799-5d73-44fc-82fe-2eb228196f2b", "from_name": null, "from_type": "Indicator", "id": "d4576f39-973d-4ab4-867c-bf14bf8651b6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--0aac8fd9-ee14-51de-9422-53804186dbf8", "toId": "5e37862a-8c99-4be9-833c-f62a683a38f4", "to_id": "5e37862a-8c99-4be9-833c-f62a683a38f4", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.943Z", "created_at": "2026-09-25T11:55:03.048Z", "modified": "2026-09-25T11:55:03.709Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:03.709Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a0f18bcc-902d-4beb-a755-3c962dd9287b", "from_id": "a0f18bcc-902d-4beb-a755-3c962dd9287b", "from_name": null, "from_type": "Indicator", "id": "d46efcfd-b952-47fd-88cc-0d5e6ba14a7c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--1eac12cf-137a-56f7-97c5-4cdfe183c8ba", "toId": "1b64d126-e54f-4228-98af-43af2b86191e", "to_id": "1b64d126-e54f-4228-98af-43af2b86191e", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.179Z", "created_at": "2026-09-25T11:59:03.036Z", "modified": "2026-09-25T11:59:03.195Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:59:03.195Z" }, "description_available": false, "entity_type": "indicates", "fromId": "412677ee-1325-4a19-9df1-a4d741481d14", "from_id": "412677ee-1325-4a19-9df1-a4d741481d14", "from_name": null, "from_type": "Indicator", "id": "dafd1893-26bb-4a78-8f88-5226b6ff3c3e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--55a603d7-4978-5f4d-aaa0-05cb779f7800", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.011Z", "created_at": "2026-09-25T11:56:10.263Z", "modified": "2026-09-25T11:56:10.496Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:56:10.496Z" }, "description_available": false, "entity_type": "indicates", "fromId": "41215419-0aec-4d9e-b644-164c3ae23d84", "from_id": "41215419-0aec-4d9e-b644-164c3ae23d84", "from_name": null, "from_type": "Indicator", "id": "db12a3d8-081c-4be8-bc31-8263ca0a7e29", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--971f11d1-894b-5ea5-8bef-dbaef52b77b0", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.348Z", "created_at": "2026-09-25T12:08:32.227Z", "modified": "2026-09-25T12:08:33.013Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:08:33.013Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aace7129-2520-4848-b85e-5a25a67c504d", "from_id": "aace7129-2520-4848-b85e-5a25a67c504d", "from_name": null, "from_type": "Indicator", "id": "e350169d-91cc-44f2-ba64-0ddc0cb6554b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--1c66892c-e5c6-51d8-9c3b-d344c64f3b35", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.892Z", "created_at": "2026-09-25T11:54:53.462Z", "modified": "2026-09-25T11:54:53.722Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:53.722Z" }, "description_available": false, "entity_type": "based-on", "fromId": "412677ee-1325-4a19-9df1-a4d741481d14", "from_id": "412677ee-1325-4a19-9df1-a4d741481d14", "from_name": null, "from_type": "Indicator", "id": "e6ec867b-0d1e-472e-8fa9-3a1b016ffca6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--6c6b9b49-b30d-5500-8e58-1c16a0ecaf6a", "toId": "d10f84bc-9c27-42d8-a851-25134aa9ae02", "to_id": "d10f84bc-9c27-42d8-a851-25134aa9ae02", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.957Z", "created_at": "2026-09-25T11:55:05.071Z", "modified": "2026-09-25T11:55:05.681Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:05.681Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a2c30c66-ab6e-44c7-b7e9-2b8bdb2b9952", "from_id": "a2c30c66-ab6e-44c7-b7e9-2b8bdb2b9952", "from_name": null, "from_type": "Indicator", "id": "eea91fb0-ed09-4bf0-a85a-d72a91c7acf1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--065326e3-5a30-54f5-8879-b266299d47b1", "toId": "a18a3441-9d37-4f90-aef5-c93a6de2bb1b", "to_id": "a18a3441-9d37-4f90-aef5-c93a6de2bb1b", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.180Z", "created_at": "2026-09-25T11:59:03.528Z", "modified": "2026-09-25T11:59:03.762Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:59:03.762Z" }, "description_available": false, "entity_type": "indicates", "fromId": "412677ee-1325-4a19-9df1-a4d741481d14", "from_id": "412677ee-1325-4a19-9df1-a4d741481d14", "from_name": null, "from_type": "Indicator", "id": "ef27e4ad-fda5-46e8-af81-0cb9267b6271", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--b6b872d8-d4c9-5854-9653-58e526e35621", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.305Z", "created_at": "2026-09-25T12:06:39.864Z", "modified": "2026-09-25T12:06:40.252Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:06:40.252Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9127dee6-f591-4bdd-b5b6-47d72e9fa3d8", "from_id": "9127dee6-f591-4bdd-b5b6-47d72e9fa3d8", "from_name": null, "from_type": "Indicator", "id": "ef760e4b-afca-472b-b01c-43b4d37cc5a8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--42a7230c-2d14-52bd-96ad-5da3312959e7", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.222Z", "created_at": "2026-09-25T12:01:42.973Z", "modified": "2026-09-25T12:01:49.905Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:01:49.905Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1772709a-daec-447f-8e9d-75dc3c2c5b7e", "from_id": "1772709a-daec-447f-8e9d-75dc3c2c5b7e", "from_name": null, "from_type": "Indicator", "id": "ef99d9d1-5e31-4d7a-9d75-5f34cdfa56c7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--19f35e61-c6c5-5f87-af7c-dc3df5121dca", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.897Z", "created_at": "2026-09-25T11:54:53.789Z", "modified": "2026-09-25T11:54:54.215Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:54.215Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3c0e91a6-24ec-4293-b3f3-fb81cb97b406", "from_id": "3c0e91a6-24ec-4293-b3f3-fb81cb97b406", "from_name": null, "from_type": "Indicator", "id": "f1274e38-f20e-4b3c-8053-79cf0a5cc5a9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--af5e9998-11bd-58b5-8f71-ed5426882289", "toId": "5da623b3-aa98-4229-a4ce-b747e5228300", "to_id": "5da623b3-aa98-4229-a4ce-b747e5228300", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.841Z", "created_at": "2026-09-25T11:54:42.736Z", "modified": "2026-09-25T11:54:43.003Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:43.003Z" }, "description_available": false, "entity_type": "based-on", "fromId": "234a9ea3-c046-4ae1-9f1e-e0b7a76073a3", "from_id": "234a9ea3-c046-4ae1-9f1e-e0b7a76073a3", "from_name": null, "from_type": "Indicator", "id": "f3e2a806-d44c-4cca-85c1-c9b60e747adb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--6b224297-ed34-5349-88fd-f4596c04930b", "toId": "950f054c-e6c3-4289-9348-2226f2b340f1", "to_id": "950f054c-e6c3-4289-9348-2226f2b340f1", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.085Z", "created_at": "2026-09-25T11:57:33.180Z", "modified": "2026-09-25T11:57:33.336Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:57:33.336Z" }, "description_available": false, "entity_type": "indicates", "fromId": "991685f9-2157-443c-a061-71dbcd5e6464", "from_id": "991685f9-2157-443c-a061-71dbcd5e6464", "from_name": null, "from_type": "Indicator", "id": "f51a3bff-fc73-4bab-976d-168f0018bc8e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--318ee181-cc9a-5d2b-8a3b-49c78a0abb5e", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.483Z", "created_at": "2026-09-25T12:10:15.351Z", "modified": "2026-09-25T12:10:15.676Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T12:10:15.676Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a2c30c66-ab6e-44c7-b7e9-2b8bdb2b9952", "from_id": "a2c30c66-ab6e-44c7-b7e9-2b8bdb2b9952", "from_name": null, "from_type": "Indicator", "id": "f5a410fc-8089-41a0-8236-d15c52415617", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--eb0feef1-9db6-5308-a215-00ffb494c4d1", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:50.209Z", "created_at": "2026-09-25T11:59:32.667Z", "modified": "2026-09-25T11:59:32.794Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:59:32.794Z" }, "description_available": false, "entity_type": "indicates", "fromId": "64386b14-02bd-437b-bf1a-c0fffba71589", "from_id": "64386b14-02bd-437b-bf1a-c0fffba71589", "from_name": null, "from_type": "Indicator", "id": "fb2c5a6a-10bf-4848-9ae7-c9a35b5aef10", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--e3b932a7-b5c6-502d-9c85-277b30617082", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.906Z", "created_at": "2026-09-25T11:54:54.985Z", "modified": "2026-09-25T11:54:56.001Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:56.001Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f2bb45a8-55e9-473a-8289-abb916ab5b5e", "from_id": "f2bb45a8-55e9-473a-8289-abb916ab5b5e", "from_name": null, "from_type": "Indicator", "id": "fc718e03-8533-4f5c-af61-64f94187704f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--12ec92d6-2db2-5911-8f0b-4c19f5c0b45a", "toId": "c381928e-6745-405a-8959-09a2c387ad02", "to_id": "c381928e-6745-405a-8959-09a2c387ad02", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.838Z", "created_at": "2026-09-25T11:54:42.073Z", "modified": "2026-09-25T11:54:42.800Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:54:42.800Z" }, "description_available": false, "entity_type": "based-on", "fromId": "734b916d-dd15-49cc-9a97-484b387c9dc8", "from_id": "734b916d-dd15-49cc-9a97-484b387c9dc8", "from_name": null, "from_type": "Indicator", "id": "ff19d80e-5c6f-48e5-93e3-70d8f62cd168", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--9296422f-6fb4-563e-aceb-dca146493cad", "toId": "17dbd244-67b9-4f83-913b-8e1537efa7b2", "to_id": "17dbd244-67b9-4f83-913b-8e1537efa7b2", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.999Z", "created_at": "2026-09-25T11:55:58.174Z", "modified": "2026-09-25T11:55:58.374Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:55:58.374Z" }, "description_available": false, "entity_type": "indicates", "fromId": "234a9ea3-c046-4ae1-9f1e-e0b7a76073a3", "from_id": "234a9ea3-c046-4ae1-9f1e-e0b7a76073a3", "from_name": null, "from_type": "Indicator", "id": "ff758fd2-a92f-4aca-9405-5449635ed439", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--6a5527ee-f437-572a-b359-1a44d171b3b1", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "kikaiverse[.]com", "description_available": false, "object_id": "a0f18bcc-902d-4beb-a755-3c962dd9287b", "object_ids": [ "1b64d126-e54f-4228-98af-43af2b86191e", "a0f18bcc-902d-4beb-a755-3c962dd9287b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a0f18bcc-902d-4beb-a755-3c962dd9287b", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-12-15T13:02:38.260Z", "validity_status": "active", "value": "kikaiverse.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "1b64d126-e54f-4228-98af-43af2b86191e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "kikaiverse.com" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "domain", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-12-15T13:02:38.260Z", "validity_status": "active", "value": "kikaiverse.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "lalitae[.]com", "description_available": false, "object_id": "ae2832ba-bddc-4c16-86f3-1c9cd4b84b0a", "object_ids": [ "27da3931-253c-48c7-bab2-0cfc5600b3e5", "ae2832ba-bddc-4c16-86f3-1c9cd4b84b0a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ae2832ba-bddc-4c16-86f3-1c9cd4b84b0a", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-12-15T13:02:38.260Z", "validity_status": "active", "value": "lalitae.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "27da3931-253c-48c7-bab2-0cfc5600b3e5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "lalitae.com" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "domain", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-12-15T13:02:38.260Z", "validity_status": "active", "value": "lalitae.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "pobel[.]studio", "description_available": false, "object_id": "d72fea1f-55d7-417a-99e7-f1978950ed30", "object_ids": [ "1a2ec485-e8a0-4840-b8f4-dabd3689054d", "d72fea1f-55d7-417a-99e7-f1978950ed30" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d72fea1f-55d7-417a-99e7-f1978950ed30", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-12-15T13:02:38.260Z", "validity_status": "active", "value": "pobel.studio" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "1a2ec485-e8a0-4840-b8f4-dabd3689054d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "pobel.studio" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "domain", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-12-15T13:02:38.260Z", "validity_status": "active", "value": "pobel.studio" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "pobelstudio[.]com", "description_available": false, "object_id": "13c168da-e080-4318-a177-29370ad6ae75", "object_ids": [ "13c168da-e080-4318-a177-29370ad6ae75", "84fb7845-8474-4b0a-902d-864a3d09a81d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "13c168da-e080-4318-a177-29370ad6ae75", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-12-15T13:02:38.260Z", "validity_status": "active", "value": "pobelstudio.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "84fb7845-8474-4b0a-902d-864a3d09a81d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "pobelstudio.com" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "domain", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-12-15T13:02:38.260Z", "validity_status": "active", "value": "pobelstudio.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "softcus[.]net", "description_available": false, "object_id": "8e3c2799-5d73-44fc-82fe-2eb228196f2b", "object_ids": [ "5e37862a-8c99-4be9-833c-f62a683a38f4", "8e3c2799-5d73-44fc-82fe-2eb228196f2b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8e3c2799-5d73-44fc-82fe-2eb228196f2b", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-12-15T13:02:38.260Z", "validity_status": "active", "value": "softcus.net" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "5e37862a-8c99-4be9-833c-f62a683a38f4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "softcus.net" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "domain", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-12-15T13:02:38.260Z", "validity_status": "active", "value": "softcus.net" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "w3pi[.]social", "description_available": false, "object_id": "a2c30c66-ab6e-44c7-b7e9-2b8bdb2b9952", "object_ids": [ "a18a3441-9d37-4f90-aef5-c93a6de2bb1b", "a2c30c66-ab6e-44c7-b7e9-2b8bdb2b9952" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a2c30c66-ab6e-44c7-b7e9-2b8bdb2b9952", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-12-15T13:02:38.260Z", "validity_status": "active", "value": "w3pi.social" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "a18a3441-9d37-4f90-aef5-c93a6de2bb1b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "w3pi.social" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "domain", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-12-15T13:02:38.260Z", "validity_status": "active", "value": "w3pi.social" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "147[.]124[.]202[.]205", "description_available": false, "object_id": "37aa4704-03f7-42da-ae3a-82dc2766e422", "object_ids": [ "37aa4704-03f7-42da-ae3a-82dc2766e422", "f627b03b-c9e7-4fcc-b282-404d03a6c541" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "37aa4704-03f7-42da-ae3a-82dc2766e422", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-09-24T03:42:09.434Z", "validity_status": "revoked", "value": "147.124.202.205" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "f627b03b-c9e7-4fcc-b282-404d03a6c541", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "147.124.202.205" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "ipv4", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-09-24T03:42:09.434Z", "validity_status": "revoked", "value": "147.124.202.205" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "162[.]0[.]239[.]85", "description_available": false, "object_id": "734b916d-dd15-49cc-9a97-484b387c9dc8", "object_ids": [ "17dbd244-67b9-4f83-913b-8e1537efa7b2", "734b916d-dd15-49cc-9a97-484b387c9dc8" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "734b916d-dd15-49cc-9a97-484b387c9dc8", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-09-24T03:42:09.434Z", "validity_status": "revoked", "value": "162.0.239.85" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "17dbd244-67b9-4f83-913b-8e1537efa7b2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "162.0.239.85" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "ipv4", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-09-24T03:42:09.434Z", "validity_status": "revoked", "value": "162.0.239.85" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "01955691147a036e2104a16f9c3b34d11cb3304e184ed9d533325705599b876b", "description_available": false, "object_id": "234a9ea3-c046-4ae1-9f1e-e0b7a76073a3", "object_ids": [ "234a9ea3-c046-4ae1-9f1e-e0b7a76073a3", "950f054c-e6c3-4289-9348-2226f2b340f1" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "234a9ea3-c046-4ae1-9f1e-e0b7a76073a3", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "01955691147a036e2104a16f9c3b34d11cb3304e184ed9d533325705599b876b" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "950f054c-e6c3-4289-9348-2226f2b340f1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "01955691147a036e2104a16f9c3b34d11cb3304e184ed9d533325705599b876b" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "01955691147a036e2104a16f9c3b34d11cb3304e184ed9d533325705599b876b" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "08425172a2dc19516ba9a3fcca8a0a789962d9b95d1792974f69c086ee64aec9", "description_available": false, "object_id": "41215419-0aec-4d9e-b644-164c3ae23d84", "object_ids": [ "0643520a-ced4-4e0e-9185-3715a7bc2cab", "41215419-0aec-4d9e-b644-164c3ae23d84" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "41215419-0aec-4d9e-b644-164c3ae23d84", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "08425172a2dc19516ba9a3fcca8a0a789962d9b95d1792974f69c086ee64aec9" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "0643520a-ced4-4e0e-9185-3715a7bc2cab", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "08425172a2dc19516ba9a3fcca8a0a789962d9b95d1792974f69c086ee64aec9" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "08425172a2dc19516ba9a3fcca8a0a789962d9b95d1792974f69c086ee64aec9" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "0882bb158878a1ca19320f5160dc93f4608c862f3ab652671bb92a82b2f1eb39", "description_available": false, "object_id": "53901640-201f-481f-9d1b-cac560beffa4", "object_ids": [ "35b48a02-f7ea-42de-a2f3-fc2bf47ed944", "53901640-201f-481f-9d1b-cac560beffa4" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "53901640-201f-481f-9d1b-cac560beffa4", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "0882bb158878a1ca19320f5160dc93f4608c862f3ab652671bb92a82b2f1eb39" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "35b48a02-f7ea-42de-a2f3-fc2bf47ed944", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "0882bb158878a1ca19320f5160dc93f4608c862f3ab652671bb92a82b2f1eb39" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "0882bb158878a1ca19320f5160dc93f4608c862f3ab652671bb92a82b2f1eb39" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "0d306f347999e02cbbe41d6ff1c47aecbc994213b3cc65bbf4aa723469e6e5ab", "description_available": false, "object_id": "65641956-bff9-4e27-b299-bf435f691e17", "object_ids": [ "42d26cd1-6154-42e5-bbfb-bf77c7608035", "65641956-bff9-4e27-b299-bf435f691e17" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "65641956-bff9-4e27-b299-bf435f691e17", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "0d306f347999e02cbbe41d6ff1c47aecbc994213b3cc65bbf4aa723469e6e5ab" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "42d26cd1-6154-42e5-bbfb-bf77c7608035", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "0d306f347999e02cbbe41d6ff1c47aecbc994213b3cc65bbf4aa723469e6e5ab" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "0d306f347999e02cbbe41d6ff1c47aecbc994213b3cc65bbf4aa723469e6e5ab" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "0e12f41c2d3d2e48b5a004bff4c126bf8e907bc6c20648f3844ed4ebad126a29", "description_available": false, "object_id": "6d0063b1-2b5b-4f43-8f51-3818e9a9a2be", "object_ids": [ "525370a3-5324-4043-b163-d2f87a227112", "6d0063b1-2b5b-4f43-8f51-3818e9a9a2be" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "6d0063b1-2b5b-4f43-8f51-3818e9a9a2be", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "0e12f41c2d3d2e48b5a004bff4c126bf8e907bc6c20648f3844ed4ebad126a29" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "525370a3-5324-4043-b163-d2f87a227112", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "0e12f41c2d3d2e48b5a004bff4c126bf8e907bc6c20648f3844ed4ebad126a29" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "0e12f41c2d3d2e48b5a004bff4c126bf8e907bc6c20648f3844ed4ebad126a29" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "1abbdeee6d03894c0c53240f7ba873fadf9367e312ada1d280420bc88f986e91", "description_available": false, "object_id": "dfd780c5-f296-49ac-ac71-bcb02c73a5fb", "object_ids": [ "8748c44d-fa7b-4aea-a0bd-21c5b3f2f2f2", "dfd780c5-f296-49ac-ac71-bcb02c73a5fb" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "dfd780c5-f296-49ac-ac71-bcb02c73a5fb", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "1abbdeee6d03894c0c53240f7ba873fadf9367e312ada1d280420bc88f986e91" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "8748c44d-fa7b-4aea-a0bd-21c5b3f2f2f2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "1abbdeee6d03894c0c53240f7ba873fadf9367e312ada1d280420bc88f986e91" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "1abbdeee6d03894c0c53240f7ba873fadf9367e312ada1d280420bc88f986e91" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "24a252e72d767d62f3076f4f59780511288ea9eedd0e30f234c9cdd5b7644cbf", "description_available": false, "object_id": "75943aae-80ff-42fb-aa8d-66545e137b5e", "object_ids": [ "308af10a-5a6f-4cc0-ad83-1e437c079166", "75943aae-80ff-42fb-aa8d-66545e137b5e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "75943aae-80ff-42fb-aa8d-66545e137b5e", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "24a252e72d767d62f3076f4f59780511288ea9eedd0e30f234c9cdd5b7644cbf" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "308af10a-5a6f-4cc0-ad83-1e437c079166", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "24a252e72d767d62f3076f4f59780511288ea9eedd0e30f234c9cdd5b7644cbf" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "24a252e72d767d62f3076f4f59780511288ea9eedd0e30f234c9cdd5b7644cbf" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "3a7fedfeb42f13b2c368c195ec83b8e8c952df7fd506133210868f3eeb06b51d", "description_available": false, "object_id": "991685f9-2157-443c-a061-71dbcd5e6464", "object_ids": [ "991685f9-2157-443c-a061-71dbcd5e6464", "c553810c-ad5a-42de-b87a-dd64bb427e41" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "991685f9-2157-443c-a061-71dbcd5e6464", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "3a7fedfeb42f13b2c368c195ec83b8e8c952df7fd506133210868f3eeb06b51d" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c553810c-ad5a-42de-b87a-dd64bb427e41", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "3a7fedfeb42f13b2c368c195ec83b8e8c952df7fd506133210868f3eeb06b51d" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "3a7fedfeb42f13b2c368c195ec83b8e8c952df7fd506133210868f3eeb06b51d" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "3cda9d3522d471a0018bc58499a424f8084b29e21776d8d63d09fe2d7eca4b49", "description_available": false, "object_id": "a4bd22c2-eb04-48d5-9f15-1dceadbb688d", "object_ids": [ "8dce0d37-1027-4edc-b0eb-a6caea2879d8", "a4bd22c2-eb04-48d5-9f15-1dceadbb688d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a4bd22c2-eb04-48d5-9f15-1dceadbb688d", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "3cda9d3522d471a0018bc58499a424f8084b29e21776d8d63d09fe2d7eca4b49" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "8dce0d37-1027-4edc-b0eb-a6caea2879d8", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "3cda9d3522d471a0018bc58499a424f8084b29e21776d8d63d09fe2d7eca4b49" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "3cda9d3522d471a0018bc58499a424f8084b29e21776d8d63d09fe2d7eca4b49" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "42620128470e26d473a128f354b77ca2c5fe9e5782e7addc1e3f863dbd0cd9b0", "description_available": false, "object_id": "837458c2-5235-4325-afee-a00f4d014b7d", "object_ids": [ "837458c2-5235-4325-afee-a00f4d014b7d", "b9ffc425-5be9-4c77-affd-095f595995a1" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "837458c2-5235-4325-afee-a00f4d014b7d", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "42620128470e26d473a128f354b77ca2c5fe9e5782e7addc1e3f863dbd0cd9b0" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b9ffc425-5be9-4c77-affd-095f595995a1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "42620128470e26d473a128f354b77ca2c5fe9e5782e7addc1e3f863dbd0cd9b0" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "42620128470e26d473a128f354b77ca2c5fe9e5782e7addc1e3f863dbd0cd9b0" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "46d382b234dcd63e66b17799b2e6cefe24ae60e10bef758c6ccf8e72ba0aaa6c", "description_available": false, "object_id": "58dc0886-3aa4-49c4-b463-59d8ac72cae9", "object_ids": [ "58dc0886-3aa4-49c4-b463-59d8ac72cae9", "6bf31ff2-35f3-4e3a-a3b7-b6ace11b7df2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "58dc0886-3aa4-49c4-b463-59d8ac72cae9", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "46d382b234dcd63e66b17799b2e6cefe24ae60e10bef758c6ccf8e72ba0aaa6c" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "6bf31ff2-35f3-4e3a-a3b7-b6ace11b7df2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "46d382b234dcd63e66b17799b2e6cefe24ae60e10bef758c6ccf8e72ba0aaa6c" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "46d382b234dcd63e66b17799b2e6cefe24ae60e10bef758c6ccf8e72ba0aaa6c" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "4c025bda19d6b7b1f9cc209876099b20130a198c18ae22b7809470dde93c62db", "description_available": false, "object_id": "add851a1-8632-4f9a-ae8a-51220e541239", "object_ids": [ "06604e94-acb3-493b-a41a-6d46a3b0a1ae", "add851a1-8632-4f9a-ae8a-51220e541239" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "add851a1-8632-4f9a-ae8a-51220e541239", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "4c025bda19d6b7b1f9cc209876099b20130a198c18ae22b7809470dde93c62db" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "06604e94-acb3-493b-a41a-6d46a3b0a1ae", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "4c025bda19d6b7b1f9cc209876099b20130a198c18ae22b7809470dde93c62db" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "4c025bda19d6b7b1f9cc209876099b20130a198c18ae22b7809470dde93c62db" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "5ab8c5808cc00825c608027d7da8611a5386de65a724fed999828310b3cb4ddb", "description_available": false, "object_id": "727b88a4-91e7-4208-8159-31e696bc23f2", "object_ids": [ "11f41381-d95f-45ea-a338-cfa27d9fb2f8", "727b88a4-91e7-4208-8159-31e696bc23f2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "727b88a4-91e7-4208-8159-31e696bc23f2", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "5ab8c5808cc00825c608027d7da8611a5386de65a724fed999828310b3cb4ddb" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "11f41381-d95f-45ea-a338-cfa27d9fb2f8", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "5ab8c5808cc00825c608027d7da8611a5386de65a724fed999828310b3cb4ddb" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "5ab8c5808cc00825c608027d7da8611a5386de65a724fed999828310b3cb4ddb" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "6b33812538be1983c94cedc82f480fd98b7ccdd3df7fa4fda863262818d07ba1", "description_available": false, "object_id": "c3310886-218b-45d9-bc70-032b0ec0b693", "object_ids": [ "c3310886-218b-45d9-bc70-032b0ec0b693", "c5b4d0cb-f102-49f0-8421-97e33fb26b03" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c3310886-218b-45d9-bc70-032b0ec0b693", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "6b33812538be1983c94cedc82f480fd98b7ccdd3df7fa4fda863262818d07ba1" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c5b4d0cb-f102-49f0-8421-97e33fb26b03", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "6b33812538be1983c94cedc82f480fd98b7ccdd3df7fa4fda863262818d07ba1" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "6b33812538be1983c94cedc82f480fd98b7ccdd3df7fa4fda863262818d07ba1" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "7030b07575e3c6558fecfd1cabc7463f10c7ca37262da7e57221a85464b7982d", "description_available": false, "object_id": "412677ee-1325-4a19-9df1-a4d741481d14", "object_ids": [ "412677ee-1325-4a19-9df1-a4d741481d14", "d10f84bc-9c27-42d8-a851-25134aa9ae02" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "412677ee-1325-4a19-9df1-a4d741481d14", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "7030b07575e3c6558fecfd1cabc7463f10c7ca37262da7e57221a85464b7982d" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "d10f84bc-9c27-42d8-a851-25134aa9ae02", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "7030b07575e3c6558fecfd1cabc7463f10c7ca37262da7e57221a85464b7982d" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "7030b07575e3c6558fecfd1cabc7463f10c7ca37262da7e57221a85464b7982d" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "791f2c56e945a2b6e99d93b10e6f42c383aa9a083ae98fc74f8720f92789c645", "description_available": false, "object_id": "3c0e91a6-24ec-4293-b3f3-fb81cb97b406", "object_ids": [ "3c0e91a6-24ec-4293-b3f3-fb81cb97b406", "5da623b3-aa98-4229-a4ce-b747e5228300" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3c0e91a6-24ec-4293-b3f3-fb81cb97b406", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "791f2c56e945a2b6e99d93b10e6f42c383aa9a083ae98fc74f8720f92789c645" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "5da623b3-aa98-4229-a4ce-b747e5228300", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "791f2c56e945a2b6e99d93b10e6f42c383aa9a083ae98fc74f8720f92789c645" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "791f2c56e945a2b6e99d93b10e6f42c383aa9a083ae98fc74f8720f92789c645" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "815a41a0c0426ffec3c9ad08e1fb125a040cf0e41acce2a86b891aeb08648d61", "description_available": false, "object_id": "64386b14-02bd-437b-bf1a-c0fffba71589", "object_ids": [ "64386b14-02bd-437b-bf1a-c0fffba71589", "af917cd2-d0a5-476c-bf64-ea8df763bdf3" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "64386b14-02bd-437b-bf1a-c0fffba71589", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "815a41a0c0426ffec3c9ad08e1fb125a040cf0e41acce2a86b891aeb08648d61" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "af917cd2-d0a5-476c-bf64-ea8df763bdf3", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "815a41a0c0426ffec3c9ad08e1fb125a040cf0e41acce2a86b891aeb08648d61" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "815a41a0c0426ffec3c9ad08e1fb125a040cf0e41acce2a86b891aeb08648d61" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "89d36570b91f59f78eaaafba19e91032dce3e6b42d4b7905d38724399bb8c8c2", "description_available": false, "object_id": "1772709a-daec-447f-8e9d-75dc3c2c5b7e", "object_ids": [ "1772709a-daec-447f-8e9d-75dc3c2c5b7e", "39e6a339-988a-4f54-89c8-4ed04fbec74a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "1772709a-daec-447f-8e9d-75dc3c2c5b7e", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "89d36570b91f59f78eaaafba19e91032dce3e6b42d4b7905d38724399bb8c8c2" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "39e6a339-988a-4f54-89c8-4ed04fbec74a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "89d36570b91f59f78eaaafba19e91032dce3e6b42d4b7905d38724399bb8c8c2" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "89d36570b91f59f78eaaafba19e91032dce3e6b42d4b7905d38724399bb8c8c2" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9ff8a6e839ebfaa185fbd53c35f1e671fe9ce6851738df07d086cae67db3e06a", "description_available": false, "object_id": "f2bb45a8-55e9-473a-8289-abb916ab5b5e", "object_ids": [ "c381928e-6745-405a-8959-09a2c387ad02", "f2bb45a8-55e9-473a-8289-abb916ab5b5e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f2bb45a8-55e9-473a-8289-abb916ab5b5e", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "9ff8a6e839ebfaa185fbd53c35f1e671fe9ce6851738df07d086cae67db3e06a" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c381928e-6745-405a-8959-09a2c387ad02", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9ff8a6e839ebfaa185fbd53c35f1e671fe9ce6851738df07d086cae67db3e06a" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "9ff8a6e839ebfaa185fbd53c35f1e671fe9ce6851738df07d086cae67db3e06a" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ab5e0684869238c1a1cabadfa0b2e4351490a6343d210ad09c09455ed352b338", "description_available": false, "object_id": "c6c50dcc-b0c4-47d9-a28a-42fa5812f363", "object_ids": [ "405c868f-69a3-4000-b890-78fb7c22e7bd", "c6c50dcc-b0c4-47d9-a28a-42fa5812f363" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c6c50dcc-b0c4-47d9-a28a-42fa5812f363", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "ab5e0684869238c1a1cabadfa0b2e4351490a6343d210ad09c09455ed352b338" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "405c868f-69a3-4000-b890-78fb7c22e7bd", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ab5e0684869238c1a1cabadfa0b2e4351490a6343d210ad09c09455ed352b338" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "ab5e0684869238c1a1cabadfa0b2e4351490a6343d210ad09c09455ed352b338" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "b07f46962c409cb854e34e06abcfc616edcc5a554a43cfac8f4f26cb818a340d", "description_available": false, "object_id": "cdb862f5-4342-4092-b1c9-cc4d537dd63d", "object_ids": [ "c59e4b72-37d4-472b-bef4-6bca94deb827", "cdb862f5-4342-4092-b1c9-cc4d537dd63d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "cdb862f5-4342-4092-b1c9-cc4d537dd63d", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "b07f46962c409cb854e34e06abcfc616edcc5a554a43cfac8f4f26cb818a340d" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c59e4b72-37d4-472b-bef4-6bca94deb827", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "b07f46962c409cb854e34e06abcfc616edcc5a554a43cfac8f4f26cb818a340d" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "b07f46962c409cb854e34e06abcfc616edcc5a554a43cfac8f4f26cb818a340d" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "d55d6419b20e7bf07025d3e464cd4bc05bc96216bf5f85dd7f9a4cbdba10d8ea", "description_available": false, "object_id": "619faf2c-6b63-4018-b17c-8252061a1863", "object_ids": [ "619faf2c-6b63-4018-b17c-8252061a1863", "a2d41cfc-5095-4ce6-aff6-635aeee6c7fc" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "619faf2c-6b63-4018-b17c-8252061a1863", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "d55d6419b20e7bf07025d3e464cd4bc05bc96216bf5f85dd7f9a4cbdba10d8ea" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "a2d41cfc-5095-4ce6-aff6-635aeee6c7fc", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "d55d6419b20e7bf07025d3e464cd4bc05bc96216bf5f85dd7f9a4cbdba10d8ea" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "d55d6419b20e7bf07025d3e464cd4bc05bc96216bf5f85dd7f9a4cbdba10d8ea" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "d9f6c4e60ca24364751e9a3f1550f3600726cb5d185407bc82078aa95ef09e53", "description_available": false, "object_id": "d775665b-ce37-4a20-89bf-ac239e81206d", "object_ids": [ "b4907ef6-d3df-4fac-94ef-95caa0f83cf4", "d775665b-ce37-4a20-89bf-ac239e81206d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d775665b-ce37-4a20-89bf-ac239e81206d", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "d9f6c4e60ca24364751e9a3f1550f3600726cb5d185407bc82078aa95ef09e53" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b4907ef6-d3df-4fac-94ef-95caa0f83cf4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "d9f6c4e60ca24364751e9a3f1550f3600726cb5d185407bc82078aa95ef09e53" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "d9f6c4e60ca24364751e9a3f1550f3600726cb5d185407bc82078aa95ef09e53" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "e328e5ecf66ac5989aa5f8fb2a7c742d475647b53c929df544b6128db16750d6", "description_available": false, "object_id": "88511034-5c64-443a-9d7b-80930844bff3", "object_ids": [ "0f0568c0-f9ae-4241-b891-e68302101329", "88511034-5c64-443a-9d7b-80930844bff3" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "88511034-5c64-443a-9d7b-80930844bff3", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "e328e5ecf66ac5989aa5f8fb2a7c742d475647b53c929df544b6128db16750d6" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "0f0568c0-f9ae-4241-b891-e68302101329", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "e328e5ecf66ac5989aa5f8fb2a7c742d475647b53c929df544b6128db16750d6" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "e328e5ecf66ac5989aa5f8fb2a7c742d475647b53c929df544b6128db16750d6" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ed3cfda8fcd1936777e3ebabb9a307325c4c2cd793416386c80bf906e4df279b", "description_available": false, "object_id": "9127dee6-f591-4bdd-b5b6-47d72e9fa3d8", "object_ids": [ "74f75ec4-6d41-4690-a1c2-ff913ccbc6bf", "9127dee6-f591-4bdd-b5b6-47d72e9fa3d8" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9127dee6-f591-4bdd-b5b6-47d72e9fa3d8", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "ed3cfda8fcd1936777e3ebabb9a307325c4c2cd793416386c80bf906e4df279b" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "74f75ec4-6d41-4690-a1c2-ff913ccbc6bf", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ed3cfda8fcd1936777e3ebabb9a307325c4c2cd793416386c80bf906e4df279b" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "ed3cfda8fcd1936777e3ebabb9a307325c4c2cd793416386c80bf906e4df279b" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "f5686109776f83123d30568e552708a7ad78964396d0f3bfd37d0332f44f8ad6", "description_available": false, "object_id": "9721ed52-bb84-4c69-85e7-694a66829f01", "object_ids": [ "14cfd48b-331d-440b-8581-058737ad8037", "9721ed52-bb84-4c69-85e7-694a66829f01" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9721ed52-bb84-4c69-85e7-694a66829f01", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "f5686109776f83123d30568e552708a7ad78964396d0f3bfd37d0332f44f8ad6" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "14cfd48b-331d-440b-8581-058737ad8037", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "f5686109776f83123d30568e552708a7ad78964396d0f3bfd37d0332f44f8ad6" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "f5686109776f83123d30568e552708a7ad78964396d0f3bfd37d0332f44f8ad6" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "f9e29c72088f4a7f7789755cd08057f0125c42b352187951623d9290ed0ace1f", "description_available": false, "object_id": "9e2bc73a-d14e-46e2-a2f7-dc8561e12691", "object_ids": [ "75bda196-60cc-4651-8621-816983bbfc37", "9e2bc73a-d14e-46e2-a2f7-dc8561e12691" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9e2bc73a-d14e-46e2-a2f7-dc8561e12691", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "f9e29c72088f4a7f7789755cd08057f0125c42b352187951623d9290ed0ace1f" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "75bda196-60cc-4651-8621-816983bbfc37", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "f9e29c72088f4a7f7789755cd08057f0125c42b352187951623d9290ed0ace1f" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "f9e29c72088f4a7f7789755cd08057f0125c42b352187951623d9290ed0ace1f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "fab2e8e1ac22c5d14fd6531efe4e8e05ca9246786154b2d2f3b7f425777f4818", "description_available": false, "object_id": "aace7129-2520-4848-b85e-5a25a67c504d", "object_ids": [ "2f70ef8a-e52b-4d8e-918e-713658c4b7c6", "aace7129-2520-4848-b85e-5a25a67c504d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "aace7129-2520-4848-b85e-5a25a67c504d", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "fab2e8e1ac22c5d14fd6531efe4e8e05ca9246786154b2d2f3b7f425777f4818" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "2f70ef8a-e52b-4d8e-918e-713658c4b7c6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "fab2e8e1ac22c5d14fd6531efe4e8e05ca9246786154b2d2f3b7f425777f4818" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "sha256", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2027-06-21T09:17:14.557Z", "validity_status": "active", "value": "fab2e8e1ac22c5d14fd6531efe4e8e05ca9246786154b2d2f3b7f425777f4818" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//147[.]124[.]202[.]205/api/service/makelog", "description_available": false, "object_id": "c978d5c5-874a-4994-aafb-baf0cfbc546c", "object_ids": [ "b131436d-65d7-403e-8cb3-6964a265bf65", "c978d5c5-874a-4994-aafb-baf0cfbc546c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c978d5c5-874a-4994-aafb-baf0cfbc546c", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-09-24T03:42:09.434Z", "validity_status": "revoked", "value": "http://147.124.202.205/api/service/makelog" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "b131436d-65d7-403e-8cb3-6964a265bf65", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://147.124.202.205/api/service/makelog" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "url", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-09-24T03:42:09.434Z", "validity_status": "revoked", "value": "http://147.124.202.205/api/service/makelog" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//162[.]0[.]239[.]85[:]3000/task/package[.]json", "description_available": false, "object_id": "088c5012-ddcb-4c76-8bbb-aaa384ecebbc", "object_ids": [ "088c5012-ddcb-4c76-8bbb-aaa384ecebbc", "d576c37a-8763-4066-a1e8-a6d792526fc5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "088c5012-ddcb-4c76-8bbb-aaa384ecebbc", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-09-24T03:42:09.434Z", "validity_status": "revoked", "value": "http://162.0.239.85:3000/task/package.json" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "d576c37a-8763-4066-a1e8-a6d792526fc5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://162.0.239.85:3000/task/package.json" } ], "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "type": "url", "valid_from": "2026-09-03T22:07:30.000Z", "valid_until": "2026-09-24T03:42:09.434Z", "validity_status": "revoked", "value": "http://162.0.239.85:3000/task/package.json" } ], "mentioned": [ { "confidence": 50, "evidence_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "name": "OtterCookie", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:16:18.959Z", "created_at": "2026-02-26T09:45:20.459Z", "modified": "2026-02-26T09:45:20.639Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-26T09:45:20.639Z" }, "description_available": false, "entity_type": "uses", "fromId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_name": "DPRK", "from_type": "IntrusionSet", "id": "441825f5-5c17-4a30-89e9-11a1ec420c2c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--cd0105c2-8b5f-5dd5-bd6a-41e97218e2a1", "toId": "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "to_id": "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "to_name": "TA0008", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:16:18.960Z", "created_at": "2026-02-26T09:45:20.913Z", "modified": "2026-02-26T09:45:21.128Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-26T09:45:21.128Z" }, "description_available": false, "entity_type": "uses", "fromId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_name": "DPRK", "from_type": "IntrusionSet", "id": "a30af46a-d0b5-4708-b5a1-3dc9d0e0623a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--1b8cc33f-04e1-5b96-8c29-90d9df5b5235", "toId": "a677bfc0-d7d0-4c43-a6c7-63dd332b0edc", "to_id": "a677bfc0-d7d0-4c43-a6c7-63dd332b0edc", "to_name": "TA0040", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:16:18.957Z", "created_at": "2026-02-26T09:45:19.402Z", "modified": "2026-02-26T09:45:19.641Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-26T09:45:19.641Z" }, "description_available": false, "entity_type": "uses", "fromId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_name": "DPRK", "from_type": "IntrusionSet", "id": "bd9ae72a-7e07-4487-848f-b7e35a7fba57", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--bb8ee6a4-cf36-567e-b830-2656babc9c0a", "toId": "008dd51f-8f8d-4be2-a41b-6191033560d2", "to_id": "008dd51f-8f8d-4be2-a41b-6191033560d2", "to_name": "TA0001", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:16:18.959Z", "created_at": "2026-02-26T09:45:22.841Z", "modified": "2026-02-26T09:45:23.203Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-26T09:45:23.203Z" }, "description_available": false, "entity_type": "uses", "fromId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_name": "DPRK", "from_type": "IntrusionSet", "id": "d0efb2b2-196a-42f3-8496-31d5cae2bb18", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "standard_id": "relationship--0353cab3-7307-5c6f-ae6b-96ddb09ace9d", "toId": "b567183b-d314-4266-96a5-7c9ed53ab2b0", "to_id": "b567183b-d314-4266-96a5-7c9ed53ab2b0", "to_name": "TA0007", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "TA0008" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.150Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.150Z", "created_at": "2026-01-21T11:31:19.514Z", "modified": "2026-01-21T11:31:20.180Z", "updated_at": "2026-01-21T11:31:20.180Z" }, "description_available": false, "evidence_ids": [ "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "441825f5-5c17-4a30-89e9-11a1ec420c2c" ], "external_id": null, "id": "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-01-21T11:31:20.180Z", "name": "TA0008", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0008", "id": "ad7866d4-e709-45c7-a0b3-721cd0ac76a9", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0008" } ], "relationship_ids": [ "441825f5-5c17-4a30-89e9-11a1ec420c2c" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "tactics": [], "url": null, "via_entities": [ { "id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "name": "DPRK", "type": "IntrusionSet" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0001" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T18:16:18.950Z", "created_by": null, "dates": { "created": "2026-01-19T18:16:18.950Z", "created_at": "2026-02-26T09:42:18.208Z", "modified": "2026-02-26T09:42:18.968Z", "updated_at": "2026-02-26T09:42:18.968Z" }, "description_available": false, "evidence_ids": [ "008dd51f-8f8d-4be2-a41b-6191033560d2", "bd9ae72a-7e07-4487-848f-b7e35a7fba57" ], "external_id": null, "id": "008dd51f-8f8d-4be2-a41b-6191033560d2", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-26T09:42:18.968Z", "name": "TA0001", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0001", "id": "b9b34b9a-84bd-442c-a126-8dd241c3fecc", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0001" } ], "relationship_ids": [ "bd9ae72a-7e07-4487-848f-b7e35a7fba57" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "tactics": [], "url": null, "via_entities": [ { "id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "name": "DPRK", "type": "IntrusionSet" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0040" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T18:16:18.954Z", "created_by": null, "dates": { "created": "2026-01-19T18:16:18.954Z", "created_at": "2026-02-26T09:42:19.216Z", "modified": "2026-02-26T09:42:20.265Z", "updated_at": "2026-02-26T09:42:20.265Z" }, "description_available": false, "evidence_ids": [ "a30af46a-d0b5-4708-b5a1-3dc9d0e0623a", "a677bfc0-d7d0-4c43-a6c7-63dd332b0edc" ], "external_id": null, "id": "a677bfc0-d7d0-4c43-a6c7-63dd332b0edc", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-26T09:42:20.265Z", "name": "TA0040", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0040", "id": "431fc300-4868-4d6d-942b-0997dacf8890", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0040" } ], "relationship_ids": [ "a30af46a-d0b5-4708-b5a1-3dc9d0e0623a" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "tactics": [], "url": null, "via_entities": [ { "id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "name": "DPRK", "type": "IntrusionSet" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0007" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T18:04:26.693Z", "created_by": null, "dates": { "created": "2026-01-19T18:04:26.693Z", "created_at": "2026-02-24T10:59:25.122Z", "modified": "2026-02-24T10:59:25.604Z", "updated_at": "2026-02-24T10:59:25.604Z" }, "description_available": false, "evidence_ids": [ "b567183b-d314-4266-96a5-7c9ed53ab2b0", "d0efb2b2-196a-42f3-8496-31d5cae2bb18" ], "external_id": null, "id": "b567183b-d314-4266-96a5-7c9ed53ab2b0", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-24T10:59:25.604Z", "name": "TA0007", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0007", "id": "9e1f03d3-a465-4763-b502-2eb00bbd87eb", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0007" } ], "relationship_ids": [ "d0efb2b2-196a-42f3-8496-31d5cae2bb18" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/", "tactics": [], "url": null, "via_entities": [ { "id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "name": "DPRK", "type": "IntrusionSet" } ] } ], "via_entity": { "id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "name": "DPRK", "type": "IntrusionSet" } } ], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-03T22:07:29.610Z", "created_at": "2026-09-25T12:10:43.584Z", "modified": "2026-09-25T12:10:44.287Z", "published": "2026-09-03T22:07:29.610Z", "updated_at": "2026-09-25T12:10:44.287Z" }, "description_available": true, "id": "83f333af-0054-4e55-8605-558544a43cbc", "is_inferred": false, "labels": [ "fake job interview", "macos", "ottercookie", "trojanized installers" ], "lang": "en", "name": "Contagious Interview steps outside the developer workflow", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-03T22:07:29.610Z", "references": [ { "external_id": "6a99efa1445d8ef021e25d53", "id": "987bb140-7fb7-4c08-a3df-fc03d640620f", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6a99efa1445d8ef021e25d53" }, { "external_id": null, "id": "67c527eb-024c-4253-b024-436996fb61cb", "source_name": "malpedia", "url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/" }, "targets": [], "techniques": [], "vulnerabilities": [] }, "report_id": "83f333af-0054-4e55-8605-558544a43cbc", "schema_version": 1, "selected_date": "2026-09-04", "source_url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/" }