An international advisory says North Korea–linked actors posing as recruiters tricked jobseekers into downloading “coding assignments” during fake interview processes. Opening the files installed backdoors and malware, enabling theft from over 7,000 crypto wallets and supporting at least $10.71M in stolen funds. The campaign also risks becoming a path into future employers if infected candidates later gain legitimate jobs.
According to an international advisory, regime-backed actors posed as recruiters and targeted web designers, engineers, and cryptocurrency or Web3 specialists with bogus recruitment approaches. During the supposed interview process, victims were instructed to download files presented as coding assignments or other recruitment tests. Opening these files backdoored the applicants' computers and installed malware, giving attackers a persistent foothold on personal devices used for job hunting.
The scale reported is significant: more than 30,000 devices were compromised, more than 7,000 cryptocurrency wallets were affected, and the advisory attributes at least $10.71 million in thefts to the campaign. Post-compromise activity included deploying remote access trojans and information stealers, enabling long-term access to credentials and other sensitive data.
The pretext exploited normal hiring behavior. Candidates expect to complete coding tests or technical assignments as part of an interview process, so a request to download and run a file did not stand out as unusual. Because the activity happened on personal, often unmanaged devices, there was little enterprise security tooling present to catch the malware before it executed.
Stolen information included clipboard contents, keystrokes, cryptocurrency wallet data, and identity documents. This data can support further impersonation and even extortion, extending the impact well beyond the initial device compromise. Compromised devices can also become an entry point into corporate systems once the jobseeker secures legitimate employment.
Jobseekers should avoid downloading or opening interview assignments sent as files unless the sender and hiring process are verified through a trusted channel. Organizations should treat job-related requests for sensitive data as high risk and consider screening or controls for personal devices used in hiring workflows. Any organization suspecting it engaged a fraudulent worker should launch a full forensic investigation and assume credentials have been compromised.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Actors posing as recruiters approached web designers, engineers, and crypto/Web3 specialists, then asked them to download files framed as coding assignments or recruitment tests. Opening these files backdoored the applicants' computers and installed malware.
Post-compromise tooling included remote access trojans and information stealers that captured credentials, clipboard contents, keystrokes, cryptocurrency wallet data, and identity documents.
Compromised personal devices used during the hiring process may later provide a route into corporate systems once the jobseeker secures legitimate employment.
The advisory recommends launching a full forensic investigation and assuming that credentials and other sensitive data have been compromised.
You get a dream interview for a Web3 role… then the recruiter emails you a “coding assignment” to download and run. In a real campaign, North Korea–linked recruiters did exactly this. Those 'tests' silently backdoored over 30,000 devices and drained more than 7,000 crypto wallets, about $10.7 million gone. Here’s the nasty twist: once that personal laptop is infected, it can follow you into your next job. When you log in at a new company, the RAT and info-stealer ride along, grabbing clipboard contents, passwords, even ID documents. Your move: if any recruiter sends a file you have to download and run as a 'coding test', stop. Don’t open it, contact our security team and the hiring contact through official channels and ask for a browser-based test instead.
Researchers observed a real phishing campaign using a kit called GhostCode that abuses Microsoft’s legitimate “device code” sign-in flow to steal authentication tokens. Victims are socially engineered to open an NDA-themed HTML file and then enter a device code on Microsoft’s login page,…
Attackers are sending fake calendar meeting invites that can be automatically added to a victim’s calendar, even if the email is blocked. A documented example used a Google Calendar invite with a financial “invoice credit” lure to drive victims to a hosted webpage and download a malicious…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
Government agencies say Iranian intelligence-linked attackers are targeting dissidents, journalists, and activists with Windows malware controlled through Telegram. The attack starts with a trust-building message impersonating someone the victim knows or app support, then delivers a file disguised…
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
Researchers observed a real phishing campaign that abused Microsoft 365’s “Direct Send” feature to deliver messages that looked like they came from trusted internal addresses (HR, accounting, admin). The emails commonly used familiar business lures like invoices, payment approvals, voicemail…
