North Korean Hackers Posed as Recruiters. They Infected 30,000 Devices Worldwide (inc.com) 27
"I would like to verify your technical abilities, so please download the specified file and complete the assigned task..."
Fake job listings aimed at software developers and IT professionals led to 30,000 infected devices in over 100 countries — and 7,000 compromised cryptocurrency wallets, leading to over $10 million (USD) transferred to North Korea. Inc. reports: The hacks occurred from December 2025 through July 2026, according to a joint cybersecurity advisory issued Friday by Japanese, Australian, German, and U.S. authorities, including the Federal Bureau of Investigation and the Defense Department's Cyber Crime Center... The group reportedly has been active since 2023, carrying out both financially motivated attacks and cyberespionage...
The hackers lure job seekers through social media, online job platforms, gig-work sites and freelance marketplaces. WaterPlum asks responders to take part in virtual technical interviews or complete coding assignments. The attackers then instruct targets to download and run malicious files, sometimes under the guise of completing an assignment or troubleshooting a problem with videoconferencing software. Once the group gains access to a device or network, it uses malware to steal information, including browser passwords, screenshots, files, and cryptocurrency-wallet data. An infected computer can also provide an avenue into the network of the target's employer, opening the door to intellectual-property theft and espionage, authorities said.
The operation overlaps with a separate scheme in which North Korean nationals conceal their identities and locations to obtain remote IT work with companies abroad, officials said.
The malicious files are "hosted on multiple online collaboration software developer platforms and code repositories," the advisory points out, and includes malicious Node Package Manager (NPM) packages.."
Stolen ID images can also be used by North Korean IT workers to impersonate victims to obtain contracts and receive payment in foreign currency, but "The actors can also use stolen sensitive information for extortion." In one case, a North Korean IT worker "extorted a company over payment and published its proprietary source code online. In another case, an IT Worker hired for website maintenance defaced the hiring company's website and rendered the site inaccessible."
The advisory provides clues for employers. It warns these malicious IT workers "tend to favor payment in cryptocurrency, and they may request that remuneration be sent to an account in another person's name." During interviews they'd sometimes used Al face-swapping software, then claimed network issues and disabled their video. And "On holidays celebrated in North Korea, the actors played games and watched soccer videos instead of conducting their usual malicious activities."
Fake job listings aimed at software developers and IT professionals led to 30,000 infected devices in over 100 countries — and 7,000 compromised cryptocurrency wallets, leading to over $10 million (USD) transferred to North Korea. Inc. reports: The hacks occurred from December 2025 through July 2026, according to a joint cybersecurity advisory issued Friday by Japanese, Australian, German, and U.S. authorities, including the Federal Bureau of Investigation and the Defense Department's Cyber Crime Center... The group reportedly has been active since 2023, carrying out both financially motivated attacks and cyberespionage...
The hackers lure job seekers through social media, online job platforms, gig-work sites and freelance marketplaces. WaterPlum asks responders to take part in virtual technical interviews or complete coding assignments. The attackers then instruct targets to download and run malicious files, sometimes under the guise of completing an assignment or troubleshooting a problem with videoconferencing software. Once the group gains access to a device or network, it uses malware to steal information, including browser passwords, screenshots, files, and cryptocurrency-wallet data. An infected computer can also provide an avenue into the network of the target's employer, opening the door to intellectual-property theft and espionage, authorities said.
The operation overlaps with a separate scheme in which North Korean nationals conceal their identities and locations to obtain remote IT work with companies abroad, officials said.
The malicious files are "hosted on multiple online collaboration software developer platforms and code repositories," the advisory points out, and includes malicious Node Package Manager (NPM) packages.."
Stolen ID images can also be used by North Korean IT workers to impersonate victims to obtain contracts and receive payment in foreign currency, but "The actors can also use stolen sensitive information for extortion." In one case, a North Korean IT worker "extorted a company over payment and published its proprietary source code online. In another case, an IT Worker hired for website maintenance defaced the hiring company's website and rendered the site inaccessible."
The advisory provides clues for employers. It warns these malicious IT workers "tend to favor payment in cryptocurrency, and they may request that remuneration be sent to an account in another person's name." During interviews they'd sometimes used Al face-swapping software, then claimed network issues and disabled their video. And "On holidays celebrated in North Korea, the actors played games and watched soccer videos instead of conducting their usual malicious activities."
Smells like a scam (Score:3)
Re:Smells like a scam (Score:4, Funny)
If your first thought after "please download the specified file and complete the assigned task" isn't "Hahahahaha - no," then you're either a fool..
Dare we test LinkedIn prevalence to see just how many foolish recruiters see how 'funny' that is? Seems this comes in the form of 'homework' assignments from recruiters/potential employers these days. Hackers saw a golden opportunity to exploit.
(LinkedIn Virgin) "The hell, is that stench.."
(Veteran with 866 application deaths) "Desperation. The onsite distillery turns it into a cologne we all wear now. Choice? Hahahahaha - no. We don't."
* submits application #867 *
Re: Smells like a scam (Score:2)
Seriously, how is a job applicant supposed to be able to distinguish what a hacker asks them to do versus the typical humiliation ritual that passes for the standard employment experience we are accustomed to?
It's two slightly different flavors of abuse.
Re:Smells like a scam (Score:5, Interesting)
They are a *bit* more sophisticated than that. Basically, they are saying "here's a ZIP, it's just a git repository" - essentially, they are saying that here's a git bundle for you (instead of exposing that to Internet and asking you to do a git clone).
What happens then is that you unpack that repository, do your changes, and then do a git commit for the "assignment" they put up for posterity.
But then the pre-commit hook that they have configured fires and runs some binary blob that was included in the repository. This would of course not happen with a git clone, but when you just download an innocent-looking ZIP that has a src/ and .git/ subdirectories and git log shows "Version for applicant interviews"...you might be fooled.
So it's not just "yeah download this .EXE and allow it to run as admin okthxbye".
Re: (Score:2)
I don't think that's where they were going with that. As I read it, if you're being assigned homework before you even get an interview, you're in a trap at best.
Re: (Score:3)
At the point such a "test" involves enough overhead to merit downloading a repo, though - Yeah, no, I'm not debugging their latest production incident for free, thanks for waving that red flag right up front, guys.
Re: Smells like a scam (Score:2)
Exactly, a few questions or a short exercise to ensure that you have the basic skills required to do the job is one thing, this was masquerading as something else, specifically something no serious employer would do except to make people go away
Desperate people don't think clearly (Score:4, Interesting)
We have 25% functional unemployment. That means a quarter of the population even if they have a job cannot support themselves. Some of them are living with relatives some of them have six or seven roommates and the rest are homeless living out of cars or under bridges. We have half a million homeless people working full-time. Probably more that's an old statistic and the economy is in freefall.
You're going to start seeing more and more breakdown in places. Eventually the combination of incompetent leadership from known child sex predators combined with a massive push for automation in a world where if you don't work you don't eat is going to start eroding the tax base and the consumer spending bases to the point where we will not be able to maintain an economy. At least not a consumer based economy like we have now. Change will be inevitable and we aren't going to accept people sitting around eating bonbons and playing Xbox without working but we're not going to have anything useful for them to do and we're not going to let the government give them something useful to do.
When the tax base collapses police and fire will get shut down.
And remember no matter how good a shot you are you're going to run out of ammo before the world runs out of desperate people with nothing to lose
Re: Desperate people don't think clearly (Score:2)
We will let the government give them something "useful" to do once the pedos get us into a war.
Re: (Score:2)
I've had otherwise legitimate interviewers where they wanted me to access some weird website or install an app on my phone.
My current employer we use some interview software that tracks the desktop focus to help identify if someone is cutting and pasting into search engines or AI. Not fool proof, but there are plenty of people that didn't realize they granted some key permissions when they signed into the website.
I think it's somewhat invasive, but I just work here and do what they tell me.
Re:Smells like a scam (Score:5, Informative)
It's not so simple. They was actually "interviewed" by these guys last week.
The "recruiter" asks the candidate to clone a GitHub project and open it using Cursor. It doesn't look like you're running anything. You're just opening a project file.
The Cursor installation is legit (downloaded from the official location) and the GitHub repository is 99% source-code so it doesn't look harmful. The problem is that the repository contains a Cursor-specific configuration file that downloads and runs a binary when the project is opened.
These AI tools are not very smart, to say the least. In any case, luckily my antivirus blocked the operation; otherwise, I wouldn't have noticed.
Re: (Score:2)
If your first thought after "please download the specified file and complete the assigned task" isn't "Hahahahaha - no," then you're either a fool, or very desperate. And if you're desperate, I'm sorry for you, man. Shit's fkd up. I hope things turn out better for you.
It's not just desperation but also greed. Especially in countries where workers don't have many rights and a lot of costs like the US.
Greed is the most successful attack vector in most scams. The temptation of more money tends to blind even some of the most astute people, especially in a mercenary culture.
Re: (Score:1)
Shouldn't your OS have privilege separation and conditional access between files and processes? There's no excuse for most processes running as your user (a browser, a weather app, or a new program you're compiling, for example) to have access to files belonging to SSH, your password manager, or an email program.
Some people try to roll their own sandboxes with firejail, bubblewrap, AppArmor, etc but that's a lot of trial and error work for everyone to do themselves. We need anything with network access sand
Re: Crazy to run any untrusted code outside a VM (Score:3, Insightful)
Re: (Score:3)
Even a blank VM is a no-no, especially with hypervisor escape exploits. Maybe a Bochs style VM, but that isn't exactly snappy.
The only way I could really do this is if I went with a VPC, ran their stuff on that, then powered off and nuked the VPC afterwards... but even then, there could be really bad stuff happening.
Never happened to me (Score:4, Funny)
I've applied for over 1000 jobs the past two years and I only get automatically discarded upon clicking "Submit". I wonder what it would take for me to get scammed like this. Please help, I want some excitement in my life.
Re: (Score:2)
I've yet to receive a confirmation that my application was discarded. It's like I don't exist.
Re: (Score:2)
It's horrifying how often I've applied to jobs and then gotten ghosted. What's even worse is how often I've had a phone screen or an interview and then they ghosted me.
Ironically I got a rejection email last week for a position I applied for in January.
Re: (Score:2)
I once had a "We would like to invite you to a first stage interview" at some company. It was about 6 months after I'd applied. It took me a while to work out who they were. The job I actually took was about 1 week from application to offer.
Re: Never happened to me (Score:2)
It's probably a combination of evil recruiters who don't care about you and even more evil recruiters posting fake jobs in order to collect statistics about the postings...
Re: (Score:1)
How can the job market be in the toilet? Everything leadership tells us is that things are great and getting greater. Anyone who disagrees is just wrong.
NK 3 Crypto (Score:2)
A generation has been trained to install BS apps. (Score:2)
There is a whole generation that had phones as kids, They were constantly bombarded with prompts to install this or that app. For the most part the apps are "safe" as in the person never actually encountered what they would consider to be a negative result.
People under 30 pretty much install anything. They don't even think about it. Even IT educated ones do it.
In today's age you a strong armed into installing apps for McDonalds, that delivery service, to rent a bike in the city, to get on the train, to