North Korea’s Fake Recruiters Feed Stolen Data to IT Workers

North Korea’s threat actors behind the DeceptiveDevelopment campaign pose as recruiters to steal developers’ identities and hand them to fraudulent North Korean IT workers, according to ESET. The operation, which has been ongoing since at least 2023 and was initially described in February, targets developers in cryptocurrency and decentralised finance with fake job offers that lead to information theft and malware infections.

Using fake profiles on LinkedIn, Upwork, Freelancer[.]com and other platforms, the attackers invite victims to an interview where they are tricked into running malware on their systems. ESET notes that a secondary aim is to harvest developer identities and supply them to WageMole-linked groups so they can land remote work at western companies, with teams led by a “boss” and coordinated quotas.

The campaigns employ social engineering and malware families such as BeaverTail, InvisibleFerret, and OtterCookie, and have seen prior tooling like WeaselStore, PylangGhost, TsunamiKit, Tropidoor and AkdoorTea deployed in related attacks.