locservice.short.gy: short links that URLhaus ties to the Contagious Interview fake job campaign, and what to do if a coding test ran them

What locservice.short.gy is, and what we know about it

locservice.short.gy is not a program on your computer. It is a web address on short.gy, a link shortening service, and the abuse.ch project URLhaus lists four short links on it as places where malware files were served. All four carry the tag ContagiousInterview. We found no public write-up of this one address, so what follows is what URLhaus shows, what our own request returned, and what security vendors have published about the campaign the tag names.

1. 1

   What URLhaus lists

   Four short links, all under https://locservice.short.gy/, with the codes NAZyrea3Bs9iLbd, ZRsvn1k9l, ZRsvn1k9m and ZRsvn1k9w. They were added within about one minute, between 07:19 and 07:20 UTC on 12 October 2026, by one reporter. All four carry the threat label malware_download and were marked offline when we read them.

2. 2

   What the tags mean

   ContagiousInterview is the name researchers use for a long running campaign in which fake recruiters give developers a coding task. VSCode and npm name the two ways the task is wired up: a Visual Studio Code project, or an npm package. The file types sh, bat and js tell you what the short link hands out: a shell script (for macOS and Linux), a batch file (for Windows) and a JavaScript file.

3. 3

   What we could not confirm

   We did not download any of the files, so we cannot tell you what is inside them or which malware family they start. The short links are offline, so nobody can fetch them now, but copies of the project that points at them may still exist on the computers of people who cloned it. We also do not know who owns the locservice name on short.gy.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a mail warning or a blocked request, you are not infected by that alone. The risk is for a computer where a project or package already ran and went to fetch one of these links. A normal visitor has no reason to ask for them.

Kind of threat

Short links that URLhaus tags ContagiousInterview: malware download links used in a fake job interview campaign aimed at developers

Where the files are

hxxps://locservice[.]short[.]gy/ followed by a short code, for example hxxps://locservice[.]short[.]gy/ZRsvn1k9w: a custom name on the short.gy link service

Parent domain registered

short.gy was registered on 21 January 2021 through Gandi SAS; status client transfer prohibited (RDAP, read 12 October 2026). That is the shortener, not the locservice link

URLhaus entries

4 short links, all added on 12 October 2026 between 07:19 and 07:20 UTC; all 4 offline when we read our copy of the data

File types

One js file tagged npm, two sh files tagged VSCode, one bat file tagged VSCode

Platform

Developer computers. The bat file points to Windows, the sh files to macOS or Linux, the js file to anything that runs Node.js. We did not open them, so this is our reading of the file types

What we checked on 12 October 2026, and what we could not

Our check was a plain request to the address from our server, with no browser and no clicks. It returned HTTP 403 and a page titled Site suspended. That is the shortener blocking the address, and it clears nothing.

What happened to locservice.short.gy, from the shortener to our check

The shortener is almost six years old, but the reports on this address are only hours old. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.

1. 21 January 2021

   short.gy is registered

   RDAP shows short.gy registered on 21 January 2021 through Gandi SAS. This is the parent domain of the link service, not the locservice name, so it says nothing about who made these links.

2. 12 October 2026, 07:19 UTC

   Three links are reported

   At 07:19:07 a link tagged js and npm (code NAZyrea3Bs9iLbd) is added. At 07:19:17 two links tagged sh and VSCode (codes ZRsvn1k9l and ZRsvn1k9m) follow. All carry ContagiousInterview.

3. 12 October 2026, 07:20 UTC

   A fourth link, a batch file

   At 07:20:10 the link ZRsvn1k9w is added, tagged bat and VSCode. Together the four cover a JavaScript file, two shell scripts and a Windows batch file, which looks like one lure prepared for several operating systems. That is our reading of the file types, not something a report says.

   

4. 12 October 2026, about 08:23 UTC

   Our check

   RDAP is read and a plain request is sent from our server. The request gets HTTP 403 and the title Site suspended. All four links are offline in our data.

What the pattern suggests, and what it does not: four links created and reported within a minute fit a researcher who found a project and listed everything it fetches. That is our reading. It does not tell us how many people received the project, and it does not tell us whether anyone ran it.

What the ContagiousInterview tag means

Contagious Interview is the name Palo Alto Networks Unit 42 gave to a campaign by North Korea linked actors, according to Help Net Security's 2026 report. The attackers pose as recruiters and give developers a coding task that carries the malware. The campaign is well documented, but nothing we read describes the locservice links themselves.

How a coding test can fetch a short link

Opening a link in a browser is not how this works. A script already running on the developer's computer asks the short link for the next file, and the shortener forwards the request to wherever the operator keeps it. We did not see the project that used locservice.short.gy; this is how the vendors above describe the two methods the tags name.

1. 1

   A recruiter hands you a project

   The message looks like a normal hiring process: a job description, a call, then a coding exercise in a repository or a package. Help Net Security says the contact usually comes through LinkedIn or a job platform. The pressure to finish quickly is part of the design.

2. 2

   VS Code route: a task runs when the folder opens

   VS Code tasks are meant to automate chores such as builds. GitLab explains that a tasks.json file in the repository can run code whenever the repository is opened, and that the victim must grant trust to the folder for that to happen. The tags VSCode on the sh and bat links fit this route: the task would download and start a script.

3. 3

   npm route: an install or run script

   The js link is tagged npm. BleepingComputer, reporting Socket's research, describes malicious npm packages that load BeaverTail and InvisibleFerret and that sometimes copy the names of trusted libraries. An npm package can run code when you install it or run the project.

4. 4

   The short link is the middle man

   A short link hides the real file location in the project's code, so a reviewer sees only a harmless looking web address. It also lets the operator change or remove the file without touching the project. When the shortener blocks the link, as the 403 Site suspended answer suggests happened here, new copies stop working but old projects stay on disk.

5. 5

   A stealer and a backdoor arrive

   In the npm waves Socket described, the payloads were the BeaverTail information stealer and the InvisibleFerret backdoor. We do not know what these four files start. Treat the list in the next section as what such a campaign can do, not as proof about these files.

VS Code's own documentation says that Restricted Mode, the state of a folder you have not trusted, blocks tasks, debugging, workspace settings and extensions so that code does not run automatically, and that trying to run a task prompts you to trust the folder. That prompt is the moment that matters.

What this kind of campaign can take from a developer computer

The list below comes from the campaign write-ups, not from the four files, which we did not open. A developer computer holds more than a normal one, so the same malware reaches further.

What this can cost you

Reading the name costs nothing. The risks below apply to a computer where a project or package fetched one of these links and the file ran.

• High

  Crypto wallets

  Funds sent out of a stolen wallet cannot be reversed. If a seed phrase or a wallet file was ever on the computer, assume it is known.

• High

  Passwords and sessions

  A stealer takes saved passwords and logged in sessions. Changing passwords on the infected computer does not help, because the new ones can be seen too.

• High

  Your employer's code and systems

  A developer computer often holds keys to repositories, servers and cloud accounts. One run of a fake test on a work laptop can become a company incident, so tell your security team early.

• Medium

  Someone using the computer live

  A backdoor lets a person come back at any time and act while you are signed in.

• Medium

  Others who clone your repositories

  Trend Micro, as quoted by Help Net Security, describes the campaign becoming worm like, where a compromised developer's repository spreads malware to others. Check your own repositories before you push.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Stealers and backdoors are built to be quiet. The signs below follow from what the sources describe; none is certain, and many victims notice nothing until money or an account is gone.

Who can meet this, and who cannot

Nobody visits locservice.short.gy on purpose. The request comes from code. The people who can be affected are the ones who received, cloned or installed something. Everyone else can stop reading at the next section.

1. 1

   Developers and job seekers contacted by a recruiter

   The campaign targets people who write software, especially in blockchain, AI and web work. A message from an unknown recruiter with a coding test that arrives as a repository or a package is the pattern all the vendor reports share.

2. 2

   Anyone who installed an npm package by a copied name

   Socket found packages that mimic well known libraries. A typing mistake in an install command, or a package suggested in a chat, is enough.

3. 3

   Someone who only saw the name

   If the name came from a firewall, a DNS log, a mail filter or a scanner such as ours, only the device that asked for it is in question. If you maintain a site and found a locservice.short.gy link in it, see the section for owners further down.

Check your computer before you delete anything

Start with the question that matters: did you run a project, task or package that a recruiter or an unknown person gave you, or did a log show your computer asking for locservice.short.gy? If the answer is no and nothing else is odd, you have nothing to remove. If yes or not sure, do the checks below. None of them deletes anything.

While you check, stop using the computer for banking, crypto, work and email.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A backdoor needs the connection to be used.

2. 2

   Find the project and read tasks.json

   Look for the repository or folder you were given. Open it in a plain text editor, not in VS Code, and read the file .vscode/tasks.json. A task with runOn set to folderOpen that runs curl, wget, powershell or a script is the pattern GitLab describes. Also read package.json for install, postinstall or prepare scripts. Do not run anything from the project.

3. 3

   Search for the address

   Search the project folder for the text short.gy. A hit tells you that the project reached out to this service, but a project can use other links, so no hit does not clear it.

4. 4

   Look at startup entries on Windows

   Open Settings > Apps > Startup and look for names you did not install. Also open Task Scheduler and look in Task Scheduler Library for tasks with random names or that run a script from a user folder.

5. 5

   Look at processes

   Open Task Manager and sort the Processes tab by CPU and by network. Node.js, Python or a shell that is running with no reason deserves a look. On a Mac or Linux machine use Activity Monitor or the process list in a terminal. A process that is there is not proof, and a missing one does not clear the computer.

6. 6

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time you opened the project.

7. 7

   Check your accounts and wallets from another device

   Look at the sign in activity of email, code hosting, cloud and exchange accounts, and at wallet balances. This is quicker than any file check.

8. 8

   A scan helps, but it does not clear the computer

   A scan with Microsoft Defender or another product can find known files. Treat a clean result like a clean site test: one data point. No vendor publishes a removal procedure for these four links and we did not infect a computer, so the order of the plan is our judgement from platform pages, not a tested result.

If you run a website or a project and these links appear in it

The address is a short link, so the bad file does not live on your server. The risk is in whatever points to it. We found no source about how short.gy handles reports, so the steps below are general and not a description of that service.

1. 1

   Find what points to the link

   Search your repository, build scripts, package.json, tasks.json and site files for short.gy. Check recent commits and the people with write access.

2. 2

   Remove it and look at how it got in

   Remove the reference, then change the passwords and tokens of every account that could push to the project, and turn on two step sign in. A stolen token is a common way for such code to arrive.

3. 3

   Warn people who cloned it

   Anyone who ran the project in the meantime should follow the cleaning steps on this page. Say so plainly in the repository.

4. 4

   Report the link

   URLhaus takes reports of malware links. We did not find short.gy's own abuse page in our reading, so we cannot name a contact. Look on the service's own site.

If you use a Mac, Linux, an iPhone or an Android phone

Two of the four files are shell scripts, so this is not only a Windows matter. A phone is not the target as far as we read.