Fake Job Interview Lure Targets Crypto Staff

How the attack worked

This campaign, attributed to a North Korea-linked group known as Famous Chollima or Wage Mole, begins with outreach on LinkedIn. Attackers pose as recruiters for a cryptocurrency company, either inventing an entirely fake business or impersonating a real one using convincing websites and typosquatted domains. Targets are told they are a strong fit for a high-paying role and are directed to complete a short online assessment as the next step.

The assessment itself is designed to look professional and legitimate. It asks applicants to fill in extensive personal and career details, including name, email, LinkedIn URL, phone number, and work history. In some versions, applicants are asked to turn on their webcam, framed as a way to ensure they are not cheating on a basic multiple-choice test. Every detail submitted is handed directly to the attackers.

Why it succeeded

The campaign works because it mirrors a normal, low-friction hiring experience. A recruiter reaching out unprompted, a slick assessment portal, and a request for standard application information all look ordinary on the surface. By impersonating real crypto firms or building believable fake ones, attackers reduce the skepticism a target might otherwise apply to an unsolicited job offer.

The targeting strategy also matters. Rather than focusing on developers or technical staff, the group prioritizes non-technical roles in finance, legal, compliance, and executive support, people who may have access to company funds or know people who do. This shifts the payoff from a technical compromise to a faster path toward financial access or influence.

What to watch for

• An unsolicited recruiter message that quickly moves to a link for an

What is the ClickFake interview attack?

It is a campaign tied to a North Korean-linked group (Famous Chollima, also known as Wage Mole) that creates fake companies or impersonates real crypto firms to lure job seekers into completing a fake online assessment that harvests personal and career details.

Who is being targeted by this fake job scam?

The campaign focuses on non-technical staff such as finance, legal, compliance, and HR/recruiting employees who may have access to company funds or influence over people who do, rather than developers.

What are the warning signs of this attack?

Red flags include unsolicited recruiter messages that quickly push an assessment link, requests for extensive personal details early on, and pressure to enable a webcam during a basic multiple-choice test.

Why do attackers ask for a webcam during the assessment?

According to the source, attackers frame the webcam request as a way to prove the applicant is not cheating on the assessment, which is really a pretext to gather more information or verify identity for their scam.