CyberSIXT Search

DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdf

Read the original on virusbulletin.com (new tab)

Excerpt

DECEPTIVEDEVELOPMENT: FROM PRIMITIVE

CRYPTO THEFT TO SOPHISTICATED AI-BASED

DECEPTION

Matěj Havránek & Peter Kálnai

ESET, Czech Republic

matej.havranek@eset.com

peter.kalnai@eset.com

24 - 26 September, 2025 / Berlin, Germany

www.virusbulletin.com

DECEPTIVEDEVELOPMENT: FROM PRIMITIVE CRYPTO THEFT TO... HAVRÁNEK & KÁLNAI

2 VIRUS BULLETIN CONFERENCE SEPTEMBER 2025

ABSTRACT

DeceptiveDevelopment, also known as Contagious Interview, is a North Korea-aligned group whose activities have increased in prevalence in recent years, actively focused on cryptocurrency theft, primarily targeting freelance developers across Windows, Linux and macOS platforms. This paper presents our research, tracing the group’s evolution from early malware families like BeaverTail and InvisibleFerret to usin…

The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Virus Bulletin on virusbulletin.com.