Authorities say a North Korean group posed as recruiters and ran fake technical interviews to convince job seekers to execute malicious code. The operation infected over 30,000 devices, led to thousands of compromised cryptocurrency wallets, and allegedly generated over $10 million for North Korea.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Job hunting? Imagine a recruiter interview that secretly installs malware on your laptop. Authorities say a North Korea–linked group posed as recruiters, ran fake technical interviews, and had job seekers run malicious code, infecting over 30,000 devices and draining more than 7,000 crypto wallets. Here’s the trick: during the call, the "recruiter" sends you a script or command, pushes you to run it fast, and it’s not in a standard platform like HackerRank, Codility, or the company’s own coding tool. If any recruiter ever asks you to run code or tools they send, stop and verify the job and interview through the company’s official careers site before you touch a single command.
Attackers linked to North Korea reportedly used a fake recruiting process to trick a Binance software engineer into downloading and running a malicious code repository during a supposed job assessment. The compromise ultimately helped the attackers access Binance’s wallet systems and steal about…
Attackers are using fake calendar invitations to bypass normal email defenses and lure people into credential theft or malware downloads. The invites may appear in a user’s calendar even when the related phishing email is quarantined, making unexpected meeting entries a new route for account and…
This weekly bulletin highlights multiple real-world incidents, including phishing and impersonation campaigns. Notably, researchers found attackers using malicious “Custom GPTs” on ChatGPT to redirect victims to a Google Sites page and trick them into running commands that install remote-access…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
A weekly threat bulletin highlights a North Korea–linked campaign where attackers posed as AI or blockchain employers to trick IT professionals into getting infected and losing cryptocurrency. It also notes a phishing kit that abuses Microsoft’s legitimate device login flow to gain long-lasting…
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
