ESET reports that North Korea-aligned Lazarus actors resumed using recruitment-themed social engineering to target the drone sector. A related North Korea-aligned operation, DeceptiveDevelopment, shifted from fake job interviews to compromising software supply chains by stealing developer credentials and inserting malicious code into code repositories.
North Korea-aligned actors used recruitment themes as the entry point for two distinct campaigns. Lazarus resumed targeting the drone sector, using recruitment-themed social engineering to gain initial access, apparently to obtain knowledge of drone capabilities and manufacturing processes. Separately, DeceptiveDevelopment moved beyond fake job-interview lures into broader software supply-chain compromises, harvesting developer credentials and using that access to inject malicious code into public and private source code repositories.
In the typical scenario, a target is approached by someone posing as a recruiter or prospective employer with an invitation to a job interview for a software development opportunity. The target is then asked to use provided interview materials or to engage in a recruitment process that results in developer credentials or repository access being exposed.
Recruitment outreach feels routine and is often welcomed rather than questioned, especially by developers and engineers who are regularly approached about new opportunities. Because the pretext involves ordinary hiring activities like technical interviews or take-home assignments, requests to install tools, run code, or share access can appear to be a normal part of the process rather than a red flag.
The targeting also extended to technology and cryptocurrency companies, software developers, and other opportunistic targets, broadening the pool of people who might plausibly receive this kind of outreach without suspicion.
These techniques map to Impersonation and Phishing for Information.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Lazarus resumed recruitment-themed social engineering to gain initial access into drone-sector organizations, apparently seeking knowledge of drone capabilities and manufacturing. A related group, DeceptiveDevelopment, used fake job-interview lures to harvest developer credentials.
DeceptiveDevelopment used harvested developer credentials to inject malicious code into public and private source code repositories, moving from fake job-interview lures into broader software supply-chain compromises.
Software developers, DevOps engineers, source code repository administrators, recruiting and HR teams, and drone manufacturing employees are among those targeted, along with technology and cryptocurrency companies.
Treat unsolicited recruiting outreach involving code samples, interview tools, or repository access as suspicious until verified through official channels, and never provide developer credentials or repository access as part of a recruitment process.
A recruiter invites you to interview. Why do they need your repository? DeceptiveDevelopment uses fake job interviews to collect developer credentials. With that access, malicious code can land in public or private repositories. Lazarus also uses recruitment lures against drone firms. Here's the giveaway: an interview should assess your skills, not demand your access token. Unexpected recruiter, unfamiliar interview tool, no listing on the employer's careers site? Stop there. Before using interview materials or sharing access, check the opening on the employer's official careers site yourself.
Proofpoint described real campaigns where attackers used highly tailored, AI-style messages to make phishing and payment fraud requests appear routine. Examples included property enquiries that led to malicious meeting invitations, device-code phishing pages disguised as business services, and fake…
Retailers face a peak-season gift-card fraud campaign in which attackers use phishing emails and text messages to trick employees into giving up credentials. After gaining access, the attackers use cloud systems and sensitive data to issue unauthorized gift cards at scale and convert them into…
INTERPOL’s Operation Serengeti III led to 1,462 arrests across 21 countries and disrupted fraud, ransomware, business email compromise and other cybercrime operations. One major case involved rotating call centers that used scripted investment pitches, fake trading platforms and fraudulent websites…
Threat actors are hijacking existing email conversations, or patiently starting new ones, to build trust before sending a malicious reply. The final message commonly poses as a meeting invitation, secure message, shared file, or important document and leads to credential theft or remote-access…
MS-ISAC tracked attackers who used a phished K-12 staff account to send phishing messages to that employee’s contacts, including staff at other school districts. Because the messages came from legitimate, authenticated accounts, they could bypass normal email filters and help attackers move from…
The Skyw4lker campaign targets U.S. manufacturing, technology, and healthcare organizations with password-protected documents disguised as contracts or service proposals. Victims are sent through a Google-hosted page into a legitimate Microsoft authentication process, where completing an…
