North Korean-linked attackers reportedly used a fake job opportunity, multiple interviews, and a malicious coding assignment to compromise a Binance engineer. The scheme built trust over weeks before asking the employee to download an interview file, giving attackers a foothold in the company’s systems. Similar “contagious interview” campaigns have also targeted crypto holders, wallets, and organizations.
The operation reportedly began with an approach through a legitimate job platform, where attackers posed as a recruiter for a fictitious technology company. Over several weeks, the Binance engineer completed two rounds of credible interviews before being asked to download an interview assignment as the next step in the hiring process. That assignment contained malicious code, which gave the attackers their initial foothold. From there, they deployed malware and moved deeper into Binance systems. This pattern, sometimes called a contagious interview scheme, has reportedly been used in similar form against other crypto holders, wallets, and organizations.
The scheme worked because it mirrored a normal hiring process rather than looking like an obvious phishing attempt. Multiple interview rounds built trust over time, making a request to download a file feel like a routine part of the recruitment pipeline rather than a red flag. The target was also valuable: employees with access to sensitive infrastructure are particularly attractive to attackers because their credentials and permissions can open a path into internal systems well beyond their own device.
Organizations should treat recruiting-themed outreach toward employees with privileged access as a potential security concern, not just an HR matter. Interview assignments or coding exercises should go through an approved review process, ideally in an isolated environment, before ever touching a corporate device. Because credentials and files stolen in these schemes have reportedly led to losses beyond the infected device, including wallet private keys taken from cloud storage, response plans should extend to cloud accounts, browser sessions, and password managers, not just local file cleanup. Recruiting and HR teams, along with security engineers and IT administrators, benefit from shared awareness that a convincing, multi-step interview process does not by itself confirm legitimacy.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers approached a Binance engineer through a legitimate job platform, conducted two rounds of interviews as a fictitious company, then sent a malicious coding assignment that gave them an initial foothold once downloaded.
DPRK-linked actors reportedly use these recruiting lures specifically against employees with privileged infrastructure access, since compromising their credentials provides a path into internal systems.
Interview assignments should only be downloaded or run after independently verifying the recruiter and company, and ideally only inside an approved, isolated review environment rather than on a corporate device.
Beyond files on the device itself, cloud storage, browser sessions, password managers, and cryptocurrency wallets should be secured, since credentials gathered early can unlock connected accounts.
Two interviews. Weeks of trust. Then a download. A Binance engineer was approached on a legitimate job platform. A fictitious company held two interviews, then sent a coding assignment containing malicious code. That's the contagious-interview trick: the interviews make the file feel safe. Opening it gave access to the work device, then deeper systems. Cloud-stored wallet keys can be exposed too. Before opening any interview assignment on a work device, send it through your approved security review process.
Attackers linked to North Korea allegedly used a fake recruitment process to persuade a Binance software engineer to download a malicious coding assignment onto a work computer. They then used the compromised device, internal AI tooling, and stolen deployment credentials to reach wallet-signing…
This article describes a real and growing social-engineering technique called ClickFix, where attackers disguise malicious instructions as a familiar CAPTCHA or verification step. In one documented case, a fake free image-editing tool prompted victims to run code that installed malware designed to…
Russia-aligned group Gorbag targeted Ukrainian government, justice, defense, and transport organizations with spearphishing emails disguised as routine administrative fines and tax notices. The group used compromised government email accounts and weaponized attachments to steal browser passwords,…
A Sirius backdoor campaign used Korean-language emails that impersonated FedEx billing notices and demanded payment of a fraudulent tax invoice. The email directed recipients to a ZIP file containing a weaponized PDF, which required the recipient to approve a PDF-reader security prompt before it…
Russian-linked group UAC-0099 reportedly used a phishing email with a malicious attachment to enter the network of an unnamed Ukrainian grain logistics company. Researchers believe the group then handed access to Sandworm, which carried out a data-wiping attack two months later, disrupting the…
Check Point researchers identified a large credential-phishing campaign that used counterfeit calendar invitations to send people to fake Microsoft sign-in pages. The campaign used calendar attachments and deceptive meeting links, and targeted more than 40,000 organizations with over 302,000…
