Loading story…
North Korean hackers are using the ClickFix social engineering tactic to target job seekers in the cryptocurrency sector with fake employment offers. Victims are lured to fraudulent websites and tricked into running malicious commands, resulting in malware deployment. Attackers frequently rotate infrastructure to evade detection, emphasizing the need for vigilance among job seekers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
12 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcehackread.com
Open sourcego.theregister.com
Open sourceblog.knowbe4.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean threat actors linked to **Contagious Interview**, **Famous Chollima**, and **Lazarus** used fake job and hiring platforms to infect applicants with BeaverTail, InvisibleFerret, FlexibleFerret, FrostyFerret, GolangGhost, and related malware families. Researchers said the operation evolved from earlier job-themed campaigns into **ClickFix**-style social engineering, where victims were told to copy and paste OS-specific troubleshooting commands from bogus interview sites. The infrastructure collected visitor IP and geolocation data, checked for cryptocurrency wallet browser objects, and then delivered tailored payloads for **Windows**, **macOS**, and **Linux** through staged download chains and fake recruiter workflows. The campaign expanded beyond software developers to target **cryptocurrency**, **marketing**, and other less technical roles, reflecting a broader DPRK shift toward centralized finance and job seekers who may be less suspicious of recruiter outreach. Reports tied the activity to malicious repositories, dozens of weaponized **npm** packages, fake hiring domains such as `businesshire[.]top`, and backend infrastructure including `nvidiasdk.fly[.]dev`, while analysts also documented persistence via Run keys and LaunchAgents, password theft on macOS, and malware loaders designed to frustrate analysis through allowlists and low-volume testing. Security firms assessed the activity as an ongoing evolution of the long-running Contagious Interview operation rather than isolated incidents.
Aug 15, 2026
North Korean state-sponsored threat actors have intensified their cyber-espionage operations by targeting job seekers in the AI, cryptocurrency, and Web3 development sectors. Security researchers have uncovered a sophisticated campaign in which operatives create fake job platforms that closely mimic legitimate recruiting services, such as Lever, to lure candidates into running malicious software under the guise of interview processes or test assignments. This approach exploits the trust and secrecy inherent in job searches, making victims less likely to report suspicious activity, and is believed to be a significant source of funding for North Korea's weapons programs. In parallel, the "Contagious Interview" operation has been systematically infiltrating the npm ecosystem, with at least 197 malicious packages and over 31,000 downloads targeting blockchain and JavaScript developers. The campaign leverages a complex infrastructure involving GitHub repositories, Vercel-hosted payloads, and command-and-control servers to deliver malware through seemingly innocuous npm packages. These operations demonstrate North Korea's adaptive and persistent threat capabilities, using modern software development workflows and social engineering to gain long-term access to sensitive systems in the tech industry.
Jun 29, 2026
North Korea-aligned threat actors, tracked as DeceptiveDevelopment or Contagious Interview, have intensified campaigns targeting software developers in the cryptocurrency and Web3 sectors. These attackers use fake recruiter profiles and staged job interviews to deliver trojanized codebases and malware, including infostealers like BeaverTail, OtterCookie, WeaselStore, and the modular remote access tool InvisibleFerret. Recent research also uncovered a new backdoor, AkdoorTea, and additional tools such as TsunamiKit and Tropidoor, all deployed through sophisticated social engineering tactics across Windows, Linux, and macOS platforms. The group leverages platforms like LinkedIn, Upwork, and GitHub to lure victims, often instructing them to execute malicious scripts under the guise of coding assessments or technical troubleshooting. ESET's analysis links these operations to North Korean IT workers involved in fraudulent job schemes, highlighting the group's financial motives and broad operational scale.
Aug 14, 2026