Hunting North Korea's job adverts on Google Docs

Using my own platform to generate my own intel to publish my own reports. It’s a closed loop!

Key takeaways

Tactical defenders will be interested in the technical steps I used to gather documents, link them together, and watch them over time to gather IOCs as FAMOUS CHOLLIMA edited them with new lures.

Those with a deeper interest in FAMOUS CHOLLIMA’s operational procedures will be interested in the longevity of the document lifetimes, suggesting long-lived and perhaps heavily used Google accounts for many parts of their playbook.

Additionally, the reuse of a specific, non-default image between a “proxy interviewee” advert and a Contagious Interview lure provides tangible evidence of asset reuse between the Contagious Interview campaign and the IT Workers campaign.

Context

If you’ve never read my blog before, shame on you. My latest hobby is tracking FAMOUS CHOLLIMA, a splinter of DPRK’s offensive cyber operations.

FAMOUS CHOLLIMA is known for two distinct but thematically similar campaigns:

• IT Worker scheme (aka WageMole): earning salaries as fraudulent insiders
• Contagious Interview (aka DevPopper): a high-pace malware operation targeting developers for monetary gain using infostealing malware to drain cryptocurrency wallets.

My main view into FAMOUS CHOLLIMA’s operations is my corpus of npm packages that faciliate the Contagious Interview campaign, but I find every aspect of their work fascinating.

Separate to my npm tracking, in early 2026, I released a collection of extracted metadata from public Google Docs at dochunt.kmsec.uk. It works by extracting Doc metadata from HTML, and leverages urlscan and Common Crawl for the corpus.

North Korea’s docs

I have a confession to make. In the intro to my launch post on dochunt and parsing Google Docs, I said I needed a break from DPRK hunting. That was a half-truth. I did want a technical challenge other than analysing JavaScript malware with no end, but the whole trigger for me wanting to mine Docs HTML was North Korea’s Contagious Interview.

You see, for some time, I’ve been watching FAMOUS CHOLLIMA’s interview tasks on Google Docs. There are a couple of ways I’ve found them but my greatest success came from hunting urlscan.

Here’s a screenshot from urlscan of a Google Doc that advertises a technical assessment that prospective hires must complete. There are multiple tabs but they all lead to the same link:

The repository it links to has long been taken down, but it would have triggered a multi-stage infection chain leading to infostealing malware like OtterCookie or InvisibleFerrett.

Unfortunately, urlscan is unable to “see” the bitbucket.org link in the Google Doc and surface it as a risk factor, which makes automated triage of malicious Google Docs impossible with just urlscan’s metadata (which is why I made dochunt!). But urlscan is still a very powerful tool for pivoting!

On urlscan, you can filter for things like page.title (the <title> HTML content). The page.title attribute for a Google Doc is <document title> - Google Docs, so simply pivoting on that attribute leads to more job adverts.

Below, I pivot on the above screenshot’s doc title to gather two more malicious coding task docs.

Recruiting proxy interviewees

I didn’t just find interview tasks for Contagious Interview, I also found strong evidence of recruitment for their IT Workers scheme — specifically recruitment of “proxy interviewees”, people who can conduct interviews on a FAMOUS CHOLLIMA operator’s behalf.

By pivoting on the hash of an image loaded into a Google Doc, I was able to tie “proxy interviewee” job adverts to the Contagious Interview lures I had been collating:

There are 5 distinct results for hash de7f4a6cc9faa9e8cd165e77963b278f9c377978b1b4a0be58e41b4b1f4a525b. Four are blockchain developer interview tasks, while the latest is a “Proxy Interviewee” advert. View the side-by-side image below that demonstrates the visual semblance between the Contagious Interview lure and the Proxy Interviewee advert:

The banner photo has a limited footprint on the web and it’s not a banner that Google Docs offers by default. Selecting this specific image would have been a manual process for the author.

• view Proxy Interviewee doc on urlscan
• view Contagious Interview coding task doc on urlscan

💬 Comment

Given the low prevalence of this image online and the evidence of asset re-use across the other blockhain role adverts, the “Proxy Interviewee” advert was highly likely created from the same template or by the same FAMOUS CHOLLIMA operator.

This was a really neat finding. We know from prior reporting that the same cells conduct Contagious Interview and the IT Worker scheme, but this image re-use gives us a small glimpse into how blurred those lines are at times.

Unfortunately, we’re reaching the limit for what we can find on urlscan. If only there was a website that allowed you to freetext-search Google Docs…😉

Pivoting on dochunt

Up till now, we’ve found several FAMOUS CHOLLIMA docs on urlscan by pivoting on attributes like the page.title and image resource hashes. Now, I want to demonstrate the utility of dochunt.

Using dochunt’s search functionality, we can also find Contagious Interview lures using the document title:

title:"test requirement" - check out the results - all FAMOUS CHOLLIMA!

Moreover, we can also get straight to actionable documents by looking for an outgoing link. We can switch out searching for a specific title attribute to hunting for anything containing “blockchain”:

links:"bitbucket" AND blockchain - more FAMOUS CHOLLIMA, some noise

Examining outgoing links and full text search on parsed content makes dochunt a powerful tool for hunting.

Here’s a query I used to hunt for proxy interviewee job adverts:

proxy AND interview* AND remote AND compensation - likely FAMOUS CHOLLIMA results mixed in with lots of noise

That was just a short exercise in how to hunt on dochunt.

Edit history

After identifying interesting docs, we can zero in on a document to understand its edit history:

urlscan picked up three revisions with markedly different text in a 20-day period. urlscan is unable to surface these edits, but dochunt extracts the revision metadata that suggests active tailoring of the job advert to make it more enticing to prospective facilitators.

Watching docs over time

dochunt’s revision collation shows that, unsurprisingly, FAMOUS CHOLLIMA are not concerned at all with document re-use. By checking in on several docs over time, I was able to watch FAMOUS CHOLLIMA change coding task repositories over the course of days.

I identified 10 documents containing links with lures for Contagious Interview and tracked them over the course of several weeks to generate the following timeline:

What’s notable about the timeline is the longevity of some of these documents. 1J1Y…v9YI had a lifetime of over a year, having been created in April 2025 and the last observed edit in roughly April 2026.

Below you can click through to view each document’s page on dochunt, showing each revision and their contents.

• 117z2gQBTTYydkEOS4BHjdxYjIbycgjvgFHIkYZ5rQ2E
• 12wwfZJVsv5oFiVvH99xasxtuU7JcxQdZNSAs6wrG24c
• 19x-cO3YqihSWt34JojRJo71YDzyTZFCGIko8Ognfkb8
• 1J1YwL0a94brFB8v_-zh8WVGlNxtZmjmRiRP5Gbpv9YI
• 1LmnsyTDso3v01Sev1ERQd5g0M2f_RAjz70jekIhxtIg
• 1rFAazbDieiqGnZXtciXPD2Fec05RXP_cXCKyMQsoxwA
• 1SuOrFpMm7v9IiPW-f-UOUYVm8EhnxsMkvWnqtBkhTPQ
• 1utjBuSCPTowBAizoL7GWt4039P1o62YBTerSyM-WOKs
• 1WxH4K5V-X4RwFxLxRINKX0iBwZtPd30z68mlV2-12JQ
• 1WxU9CUL4YeB6-Xbulnt8Qf-iANOgv_x1XbOihTG5lI0

Assessment

FAMOUS CHOLLIMA have abused Google Docs for over a year and it’s highly likely they will continue to do so throughout 2026. It is unclear where and how FAMOUS CHOLLIMA are advertising proxy interviewee roles, but the image asset reuse across a poisoned coding task and a proxy interviewee advert contributes to a high confidence attribution of this proxy interview role to FAMOUS CHOLLIMA.