2026-04-08 · 2026-Q2
UNC1069 Contagious Interview Cross-Ecosystem Package Campaign
Outside the model: Adjacent ecosystemAgent tooling was not the attack surface, so no layer applies.
- Fixable
- Architectural
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Not applicable
Target
npm, PyPI, Go, Rust, Packagist registries (developer tooling impersonation)
Impact
1,700+ malicious packages identified since January 2025 fueling espionage and financial theft; SEAL blocked 164 UNC1069 domains impersonating Teams and Zoom between Feb 6 and Apr 7, 2026
Root cause
DPRK-linked UNC1069 (overlaps BlueNoroff, Sapphire Sleet, Stardust Chollima) publishing malware-loader packages disguised as dev tooling; delivery via fake Zoom/Teams ClickFix lures after LinkedIn/Telegram/Slack social engineering
Sources
Catalog
Cite this: AgentProv incident record: UNC1069 Contagious Interview Cross-Ecosystem Package Campaign (2026-04-08). https://agentprov.com/incidents/2026-04-08-unc1069-contagious-interview-cross-ecosystem-package-campaign