North Korean-linked phishing campaign targets developers with fake job offers to steal cryptocurrency
By
Jessica Lyons
Kettled twice. Extra chewy, extra trustworthy.
Summary
A suspected North Korean-linked phishing crew sent over 250 fake developer job pitches to employees at nearly 100 organizations (mostly US-based) over six weeks in April and May. The campaign targets developers' cryptocurrency wallets and credentials through unsolicited job offers that appear too good to be true. Unlike previous DPRK-linked schemes, this one does not involve embedding IT workers at tech companies but instead focuses on credential and crypto theft via phishing emails.
Key quotes
· 3 pulledA previously unseen phishing crew, suspected to have DPRK ties, sent more than 250 emails to people working in almost 100 organizations, mostly based in the US, over six weeks in April and May.
According to security sleuths, it is yet another digital-heist attempt designed to steal cryptocurrency wallets and developers' credentials.
When an unsolicited job offer sounds too good to be true …
You might also wanna read
North Korea's Fake IT Worker Scheme: 100,000 Workers Funnel $500M Annually to Regime
Researchers from IBM X-Force and Flare Research have uncovered North Korea's extensive fake IT worker scheme, where approximately 100,000 No
theregister.com·3mo ago
How a Fake Job Interview Nearly Installed Malware on My Computer
A developer shares a personal account of nearly falling victim to a sophisticated job interview scam where a fake blockchain company recruit
blog.daviddodda.com·8mo ago
Developer discovers remote code execution backdoor hidden in fake crypto startup job offer on LinkedIn
A security-conscious developer receives a LinkedIn job offer from a recruiter at a crypto startup. Suspicious of the request to review a Git
Developer discovers remote code execution backdoor hidden in fake crypto startup job offer on LinkedIn
A security-conscious developer receives a LinkedIn job offer from a recruiter at a crypto startup. Suspicious of the request to review a Git
How a botnet abused my open source project's cloud version to phish 14,000 people
The author, who runs an open source project management tool called Kaneo, discovered that a botnet had abused the hosted cloud version of th
andrej.sh·18d ago
Addressing the Pervasive Problem of Fake North Korean IT Workers
The article discusses the prevalence of fake North Korean IT workers in companies, with insights from cybersecurity experts and Google repre
theregister.com·11mo ago
South Korean Tax Authorities Lose Seized Cryptocurrency After Posting Wallet Passwords Online
South Korean tax authorities seized approximately $5.6 million in cryptocurrency from tax evaders but inadvertently lost a significant porti
gizmodo.com·3mo ago