ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://jsonkeeper.com/b/LOXUW.

Database Entry

IOC ID:	1957038
IOC:	https://jsonkeeper.com/b/LOXUW
IOC Type :	url
Threat Type :	payload_delivery
Malware:	ContagiousDrop
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
ASN:	AS14061 DIGITALOCEAN-ASN
Country:	US
First seen:	2026-10-08 08:52:21 UTC
Last seen:	never
UUID:	1642a61d-c2f5-11f1-bd13-42010aa4000a
Reporter	Dethanc
Reward	5 credits from ThreatFox
Tags:	ContagiousInterview vscode vscode-tasks-folderOpen
Reference:	https://www.threatlocker.com/blog/malicious-vs-code-tasks-json-abuse-enables-multi-stage-infostealer-deployment

Dethanc

Stager domains for Contagious Interview attack - interviewee is asked to clone repo that contains tasks.json, which auto-runs code in VSCode. This code harvests local credentials and sends them to these domains, which then respond with additional code to be executed on the compromised machine.