It’s believed the stolen cryptocurrency was funneled to the Democratic People’s Republic of Korea (DPRK) government, which also uses fake IT personnel working at legitimate companies to net $500 million annually . The operation also steals credentials and personal data, which it later uses to apply for openings at Western companies. Amazon has seen an example of this in late 2025, with over 1,800 suspected North Korean applications blocked by the company since April 2024.
The attacks occur when fake recruiters ask legitimate applicants to complete coding assignments and other tests to evaluate their skills. However, these often have hidden malware that gives the attackers access to the victim’s computer. These persistent remote access trojans (RATs) allow the WaterPlum group to access an infected system even months after the interview. Since the compromised computer is likely the same device that the targeted applicant will use once they get a legitimate job at another company, it could also be used by the North Koreans as a springboard to attack the systems of and steal credentials from their future clients.
International agencies say these fake recruiters often target software developers and IT professionals with attractive openings, using the names of legitimate AI, cryptocurrency, and NFT companies and posting openings on online job platforms, social media, gig work platforms, and freelance marketplaces. These fake IT workers and similar schemes are used by the hermit kingdom to generate revenue, especially since it has been largely excluded from the wider international economy due to sanctions.
Many companies are aware of this and are taking steps to protect themselves against similar tactics, but it’s probably harder for individual users who are simply looking for opportunities online to do so. Potential applicants can protect themselves by applying only directly with the company and on legitimate platforms, and if they’re unsure about an opening, they should contact the company directly to confirm its legitimacy. If they decide to go to an interview, it would also be wise to set up an isolated virtual machine just for that purpose, giving them an additional layer of protection against potential attacks.
Florida Man arrested after stealing $220,000 in crypto using malware hidden in Steam Games
AI coding agents can be tricked into installing malware via 'clean' GitHub repositories
Fake Go DNS scanner spread malware through over 200 GitHub repos
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/north-korea-used-job-interviews-to-deploy-malware-on-30-000-devices-during-coding-tests-waterplum-group-loots-usd10-7-million-in-crypto-and-plants-persistent-rats#main
- https://www.tomshardware.com/membership
- ‘Now We Can Know Everything and Do Anything,’ Jensen Huang Says at Dreamforce
- Huawei shelves global AI chip rollout as China's own demand outstrips supply
- TypeSafe AI's Jev offers an alternative to LLMs that claims to be 193x faster and 445x cheaper
- Physical AI Takes the Wheel: How the World’s Robotaxi Leaders Are Building With NVIDIA Technologies
- AI-controlled robot arms attempted harmful tasks 97% of the time; experiments included stabbing a baby doll, mixing chemicals
Informational only. No financial advice. Do your own research.