Malware Gangs Enlist Covert North Korean IT Workers in Corporate Attacks

Malware operators aligned with North Korea have forged a sophisticated partnership with covert IT workers to target corporate organisations worldwide, according to a new white paper presented at Virus Bulletin 2025. The research links the DeceptiveDevelopment cybercrime syndicate with the WageMole activity cluster, describing a hybrid threat that combines cybertheft tooling with fraudulent employment schemes.

DeceptiveDevelopment, active since at least 2023, lures software developers with fake job offers on LinkedIn, Upwork and Freelancer, and victims download trojanized code from private GitHub or Bitbucket repositories, triggering BeaverTail, an infostealer that exfiltrates cryptocurrency wallets, browser credentials and keychain data.

Parallel to these operations, covert North Korean IT workers—dubbed the WageMole cluster—have infiltrated corporate hiring processes since at least 2017, using stolen identities and AI-generated synthetic profiles to bypass screening and steal internal data for extortion or espionage.

The OSINT research reveals transactional ties between DeceptiveDevelopment and WageMole through fake recruiter profiles and shared email accounts, with teams based in China, Russia and Southeast Asia spending long hours on remote assignments. Defenders are urged to adopt a holistic approach, including recruitment vetting and multi-factor verification, to mitigate this evolving threat.