Trojanized Next.js Game Project Hid Multi-Stage Malware With Python Backdoor and TsunamiKit Loader

A seemingly ordinary Next.js memory game was found to conceal a multi-stage infection combining JavaScript, a bundled private Python runtime, a remote-access backdoor, and a TsunamiKit loader. Analysts recovered samples showing that an embedded TsunamiInjector hides 1,000 Pastebin profile URLs and prepares a misleading Runtime Broker.exe installer. Two recovered files were found to share an identical decoded TsunamiInjector template, allowing much of the attack to be reconstructed directly from artifacts. The campaign matches the Contagious Interview / DeceptiveDevelopment ecosystem that prior researchers have linked to North Korea-aligned operations. The findings add a specific, documented example of the same tooling and techniques.