A weekly threat bulletin highlights a North Korea–linked campaign where attackers posed as AI or blockchain employers to trick IT professionals into getting infected and losing cryptocurrency. It also notes a phishing kit that abuses Microsoft’s legitimate device login flow to gain long-lasting access to Microsoft 365 accounts without directly stealing passwords.
This campaign, tracked as WaterPlum or "Contagious Interview," relied on attackers posing as AI or blockchain employers to reach IT professionals, developers, and blockchain engineers. The pretext was simple and effective: a recruiter reaches out on a platform like LinkedIn, offers an interview for an AI or blockchain role, and asks the target to complete a task as part of the process. That task becomes the delivery mechanism for infection. According to the findings, this approach infected at least 30,000 devices across more than 100 countries, with theft impacting over 7,000 cryptocurrency wallets between December 2025 and July 2026.
A separate technique described in the same bulletin involves GhostCode, a phishing kit that abuses the legitimate OAuth 2.0 device authorization flow used by Microsoft 365. Instead of stealing a password directly, the kit tricks victims into authenticating through a real Microsoft sign-in page using a device code. Attackers then capture the resulting tokens, giving them persistent account access without needing the password or bypassing MFA outright.
Both techniques work because they exploit trust in legitimate-looking processes rather than obviously malicious ones. A job interview is a normal, expected interaction for IT professionals and developers, so a request to complete a technical task does not raise immediate suspicion. Similarly, the device-code flow is a real Microsoft feature, so victims who are asked to enter a code are following what looks like a standard sign-in step, not a fake login page.
Organizations should train IT staff, developers, and crypto or finance teams to verify recruiter and employer identities independently before engaging with interview materials or running provided code. Employees across the organization, including executives and HR, should be taught to treat any unexpected device-code sign-in request as suspicious, since MFA alone does not stop token capture. Building awareness around both the recruiter pretext and the device-code flow reduces the chance that either technique succeeds against a given target.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a North Korea linked campaign called WaterPlum that posed as AI or blockchain employers to target IT professionals, infecting at least 30,000 devices across more than 100 countries.
By posing as employers and engaging IT professionals in a fake interview process, attackers gained access that led to theft impacting over 7,000 cryptocurrency wallets.
It is a technique where a phishing kit called GhostCode abuses the legitimate OAuth 2.0 device authorization flow so victims authenticate through Microsoft while attackers capture tokens, gaining persistent account access without stealing a password or directly bypassing MFA.
Not fully. Since token-based device-code attacks capture access tokens rather than passwords, users must avoid approving unexpected sign-in requests even if MFA is enabled.
Imagine a LinkedIn recruiter for an AI or blockchain role… and that “interview” quietly infects your laptop. WaterPlum, also called Contagious Interview, posed as AI or blockchain employers, hit at least 30,000 devices, and drained over 7,000 crypto wallets when IT pros ran “interview tasks.” Now add GhostCode: an email says, “Use this Microsoft device code to sign in and complete verification.” You really log in to Microsoft, but they capture tokens and keep Microsoft 365 access without your password or even breaking MFA. Your move: if a recruiter wants you to run files, or an email pushes a Microsoft device code you didn’t start, stop and verify the company or sign-in using your own browser, not their link.
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
This weekly threat bulletin summarizes multiple real-world incidents, including phishing that abuses Microsoft’s legitimate app login/consent screens and a campaign that hijacks hotel Wi‑Fi captive portals. In both cases, the goal is to trick people into granting access or capturing Microsoft…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
U.S. prosecutors say a Russian national used hundreds of fake accounts on a freelance platform to send Excel files that tricked users into enabling macros, which then downloaded remote-control malware. The campaign targeted tens of thousands of users and led to thousands of infections, enabling…
