Latest / The Digital Warfare Podcast / EP. 165: North Korean Fake Job Interviews Compromise 30,000 Devices Worldwide
Transcript
- Digital Warfare: You're listening to the Digital Warfare podcast. Imagine applying for a new technology job. The recruiter looks legitimate. The company appears to operate in artificial intelligence, cryptocurrency, or web 3. You reach the technical interview, and then you're asked to download a project or complete a coding test. But there is no real job. The interview itself is the attack. A new multinational government advisory has revealed the scale of a North Korean cyber operation known as Waterplum. Commonly referred to as Contagious Interview. Authorities say the campaign compromised at least 30,000 PCs across more than 100 countries between approximately December 2025 and July 2026. More than 7,000 cryptocurrency wallets had funds or account credentials compromised, and at least $10.71 million in cryptocurrency assets were transferred to North Korea. Here's how the attack works: the operators impersonate legitimate organizations. Particularly companies associated with artificial intelligence, cryptocurrency, and NFTs. They approach developers and other technology professionals through social media, recruitment platforms, and freelance websites. The victim is invited to an interview, then comes the technical assessment. The candidate may be asked to download a project, run source code, troubleshoot an apparent video conferencing problem, or open a development project supplied by the supposed recruiter, but the files contain malware. And this is what makes the campaign particularly effective. Developers routinely download code, they install packages, they clone repositories, they open projects in development environments, they execute unfamiliar software as part of testing. The attackers are exploiting that normal professional behavior. The advisory identifies several malware families associated with the campaign. These include Beavertail, Invisible Ferret, Otter Cookie, Otter Candy, and Stoat Waffle. One technique uses malicious Visual Studio Code projects. Once the victim opens and trusts the project, configuration files can trigger malicious code. After compromise, the attackers can target browser credentials, clipboard contents, keystrokes, documents, cryptocurrency private keys, seed phrases, and other sensitive information. But this campaign does not necessarily stop with the individual developer. A compromise developer workstation can also create a path toward the developer's employer or client. Think about what may exist on that machine: GitHub credentials, cloud tokens, SSH keys, source code, API credentials, VPN access, development secrets, and authentication sessions connected to corporate environments. That turns a fake job interview into a potential enterprise security problem. There is another important dimension. The Joint Advisory connects water plum activity with North Korea's fraudulent overseas IT worker operations. Authorities say stolen identity documents can be reused to help North Korean workers impersonate legitimate individuals when seeking remote employment. The FBI and Japanese authorities assess that water plum actors and some North Korean IT workers operate under North Korea's 313 General Bureau. So, what should organizations do? First. Treat developer recruitment as part of the attack surface. Security awareness training should specifically address malicious coding tests and fake technical interviews. Second, developers should never execute unfamiliar recruitment projects directly on their primary workstation. Use isolated environments, sandboxes, or disposable virtual machines. Third, inspect unfamiliar code before running it. Pay particular attention to scripts that download additional payloads. Or execute unexpected commands. Fourth, protect developer credentials. Git repositories, cloud accounts, and production systems should use strong authentication and minimum necessary privileges. And finally, organizations should understand that recruitment attacks can become enterprise compromises. A developer may appear to be the victim, but their access may be what the attacker actually wants. And that is today's larger lesson. Social engineering is evolving. Attackers are no longer relying only on suspicious attachments or fake login pages. They are building entire scenarios around the way their targets actually work. For developers, that means repositories, coding tests, package managers, development environments, and technical interviews. The strongest phishing attack may not look like phishing at all. It may look like your next career opportunity. This has been your Digital Warfare Daily Brief. Stay secure, we'll see you tomorrow.