An international advisory says North Korea–linked actors posing as recruiters tricked jobseekers into downloading “coding assignments” during fake interview processes. Opening the files installed backdoors and malware, enabling theft from over 7,000 crypto wallets and supporting at least $10.71M in stolen funds. The campaign also risks becoming a path into future employers if infected candidates later gain legitimate jobs.
According to an international advisory, regime-backed actors posed as recruiters and targeted web designers, engineers, and cryptocurrency or Web3 specialists with bogus recruitment approaches. During the supposed interview process, victims were instructed to download files presented as coding assignments or other recruitment tests. Opening these files backdoored the applicants' computers and installed malware, giving attackers a persistent foothold on personal devices used for job hunting.
The scale reported is significant: more than 30,000 devices were compromised, more than 7,000 cryptocurrency wallets were affected, and the advisory attributes at least $10.71 million in thefts to the campaign. Post-compromise activity included deploying remote access trojans and information stealers, enabling long-term access to credentials and other sensitive data.
The pretext exploited normal hiring behavior. Candidates expect to complete coding tests or technical assignments as part of an interview process, so a request to download and run a file did not stand out as unusual. Because the activity happened on personal, often unmanaged devices, there was little enterprise security tooling present to catch the malware before it executed.
Stolen information included clipboard contents, keystrokes, cryptocurrency wallet data, and identity documents. This data can support further impersonation and even extortion, extending the impact well beyond the initial device compromise. Compromised devices can also become an entry point into corporate systems once the jobseeker secures legitimate employment.
Jobseekers should avoid downloading or opening interview assignments sent as files unless the sender and hiring process are verified through a trusted channel. Organizations should treat job-related requests for sensitive data as high risk and consider screening or controls for personal devices used in hiring workflows. Any organization suspecting it engaged a fraudulent worker should launch a full forensic investigation and assume credentials have been compromised.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Actors posing as recruiters approached web designers, engineers, and crypto/Web3 specialists, then asked them to download files framed as coding assignments or recruitment tests. Opening these files backdoored the applicants' computers and installed malware.
Post-compromise tooling included remote access trojans and information stealers that captured credentials, clipboard contents, keystrokes, cryptocurrency wallet data, and identity documents.
Compromised personal devices used during the hiring process may later provide a route into corporate systems once the jobseeker secures legitimate employment.
The advisory recommends launching a full forensic investigation and assuming that credentials and other sensitive data have been compromised.
You get a dream interview for a Web3 role… then the recruiter emails you a “coding assignment” to download and run. In a real campaign, North Korea–linked recruiters did exactly this. Those 'tests' silently backdoored over 30,000 devices and drained more than 7,000 crypto wallets, about $10.7 million gone. Here’s the nasty twist: once that personal laptop is infected, it can follow you into your next job. When you log in at a new company, the RAT and info-stealer ride along, grabbing clipboard contents, passwords, even ID documents. Your move: if any recruiter sends a file you have to download and run as a 'coding test', stop. Don’t open it, contact our security team and the hiring contact through official channels and ask for a browser-based test instead.
Attackers sent personalized fake federal court notices to more than 100,000 companies, impersonating the US District Court for the Southern District of Florida. The emails directed recipients to a counterfeit court website and offered a password-protected case file that ultimately installed…
Russian authorities arrested three suspected members of VasyGrek, also known as Fluffy Wolf, a financially motivated group that used targeted phishing to access corporate systems and steal money. In one documented case, an accounting employee opened a malicious attachment disguised as a routine…
Iran-aligned DarkBlinders used convincing recruitment offers while posing as Dubai Airports recruiters to target a high-value job seeker in Iraq. The victim was asked to complete what appeared to be a coding assessment, but the assessment package installed malware. The group also used lookalike…
Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
EU regulators are investigating Booking.com over phishing, fraudulent listings, and impersonation scams affecting travelers and accommodation partners. The article describes several real campaigns, including fake Booking.com messages that sought payment details from customers and complaint-themed…
