Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
Summary: A joint advisory from Japan, the U.S., Australia, and Germany attributes the Contagious Interview campaign to North Korean actors who have compromised at least 30,000 devices in more than 100 countries and taken funds or credentials from over 7,000 cryptocurrency wallets. The campaign, active since at least 2022 and tracked under names including WaterPlum, DEV#POPPER, and UNC5342, approaches web designers, engineers, and crypto and Web3 specialists on platforms like LinkedIn posing as recruiters, then sends coding tests that deploy malware families including BeaverTail, InvisibleFerret, and OtterCookie.
Why it matters: At least $10.71 million in cryptocurrency has been taken, and the agencies note that a successful infection lets actors move into the victim's employer for espionage and intellectual property theft - so a developer's fake job interview is a path into your corporate network.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026