North Korean 'Contagious Interview' gang hits 30,000 businesses across the world with malware following fake interviews

Date:
Mon, 21 Sep 2026 14:35:00 +0000

Description:
North Koreans are stealing millions through fake job ads.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Joint report from Japan, US, Germany, and Australia says Contagious Interview stole $10 million in crypto NK operatives used fake personas, companies, and laptop farms to infiltrate 30,000+ devices in 100 countries Agencies urge vigilance: verify applicants details, check IPs, validate certifications, and watch for cryptobased payments North Korean threat actors behind the infamous Contagious Interview campaign have so far compromised more than 30,000 devices across 100 countries, and have robbed around 7,000 people of their hard-earned cryptocurrencies.

The theft has brought more than $10 million to the North Korean government, a new report jointly released by law enforcement agencies in Japan, the United States, Germany, and Australia has found. Fake everything Contagious
Interview is a hacking campaign running for almost four years now. Sometimes its also called Operation DreamJob . Latest Videos From TechRadar Watch full video here:

The cybersecurity community in general attributes it to the government of North Korea, although more precise attribution is rather difficult.

Some researchers believe it is being done by the Lazarus Group, one of the largest and most influential state-sponsored actors around. You may like This North Korean recruitment scam was so convincing it even fooled Google North Korea expands fraudulent job resumes to target marketing, sales, and medical sector Amazon flags North Korean hacker group as being behind the surge in open source supply chain attacks

Others believe different groups are involved, labeled DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, or TAG-121.

Contagious Interview leverages the lack of skilled workers in the West to infiltrate organizations, steal sensitive data and ultimately, money. North Korean operatives would create entire fake personas on social media such as LinkedIn, and would apply to hundreds, if not thousands, of job ads across
IT, healthcare, and other industries. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me
with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

The personas are carefully crafted, using a mix of legitimate information stolen in data breaches (names, SSNs, addresses), and AI-generated images, video, and audio. If hired, the operatives would use their access to infect organizations with malware , steal login credentials and different access,
and exfiltrate sensitive files and cryptos.

The operation works the other way around, as well. Crooks would create fake companies and fake job positions, and would then reach out to their targets
to offer lucrative positions on exciting projects. As part of the hiring process, the candidates would be asked to download and work on code which, unknown to them, was malicious. The North Koreans would then pivot to their targets current employers, resulting in the same outcome. Laptop farms One of the ways organizations in the West are trying to combat this issue is by
being mindful of the IP address and the location from which their employees are logging on. To work around this challenge, the attackers have set up laptop farms - facilities located abroad (usually in countries that dont have that strict limitations, but are still NK-friendly, such as China), hosting hundreds of laptops. They would then access their targets networks through these laptops, to make sure their actual location is never revealed. What to read next A candidate who was hostile from day one never produces that baseline: Nation states spies applying for legit jobs are hard to spot Security experts targeted by fake crypto conference in scam to hand over details NordVPN warns of fake Ryanair, Emirates, Qatar Airways websites used to spread malware

The primary targets are individual web designers, engineers, and specialists working in cryptocurrency, blockchain, and Web3 technologies, it was said. Businesses should be wary when they receive numerous applications in a short time, for a position where there are usually very few applicants.

If possible, verify that IP addresses generally match the applicants claimed residence, the report states. Carefully check all contact information.
Calling an applicants phone number may reveal the number is out of service.

The agencies also warned that trying to get hired is often a group effort: Even if a single individual appears to be applying, multiple people may be collaborating behind the scenes, inflating the perceived skill set.
Therefore, businesses should verify certifications by checking registration numbers and, in case of any inconsistencies, should ask for detailed explanations.

Asking personal details about the applicants hometown, weather, or hobbies,
is often a good way to spot a scammer. Finally, it was said that North Korean IT workers tend to favor payment in cryptocurrency, and they may request that remuneration be sent to an account in another persons name.

Contagious Interview has been ongoing for roughly four years now, and during that time it evolved significantly. Security agencies warn that changes to
the standard practice could happen at any time, and that the variations to
the theme should be expected. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/north-korean-contagious-interview-gang- hits-30-000-businesses-across-the-world-with-malware-following-fake-interviews


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)