North Korean hackers targeted at least 230 people in fake cryptocurrency job interviews earlier this year, according to a report from SentinelOne and Validin.
As part of their ongoing "Contagious Interview" campaign, the attackers impersonated recruiters and invited victims to fake interviews. They created dozens of fraudulent websites and posed as major financial companies like Robinhood and eToro. The hackers mainly targeted individuals working in cryptocurrency and blockchain.
After initial communications, the victim was directed to an attacker-controlled website for a skills assessment. This site used a technique called ClickFix, where it would display a fake error message and trick the user into copying and pasting malicious commands into a command line window, thereby infecting their system.
Since March, researchers have observed the threat actors actively monitoring cyber threat intelligence to evade detection. They have made minor changes to their infrastructure and appear to be working in coordinated teams to avoid being caught.
In a separate attack on the decentralized finance industry, North Korean hackers posed as investment institution employees on Telegram. They reportedly exploited a Chrome zero-day vulnerability to gain persistent access to a DeFi organization's network after compromising an employee's device. According to the NCC Group, the hackers used multiple tools during this intrusion, including a keylogger, a screenshot utility, and several backdoors like PondRAT and RemotePE.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
