Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
Summary: Unit 42 researchers attributed two ongoing North Korean state-sponsored campaigns to job-seeking activity: Contagious Interview (CL-STA-0240), active since at least December 2022, in which actors pose as employers and persuade software developers during online interviews to install malicious NPM packages hosted on GitHub, and Wagemole (CL-STA-0241), in which actors seek unauthorized employment at US and other organizations. The Contagious Interview packages carry two newly discovered malware families, BeaverTail, a JavaScript infostealer and loader that targets cryptocurrency wallets and browser-stored credit card data, and InvisibleFerret, a Python-based cross-platform backdoor.
What's compelling: The same actor is working both sides of the hiring process, and the FBI and DOJ have reported that North Korea uses remote workers to funnel wages to its weapons programs, so a single interview or a single hire can carry the risk.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026