The job interview that installs the malware

A recruiter gets in touch about a role that fits you unnervingly well. There is a friendly video interview, then a short coding test to download and try. That is the entire attack.

Seven agencies from Japan, the United States, Australia and Germany put their names to a joint advisory on 18 September describing a North Korean group they call WaterPlum, known to researchers as Contagious Interview. Between December 2025 and July 2026 it landed on more than 30,000 computers across over 100 countries. The operators took credentials for roughly 7,000 cryptocurrency accounts and moved about 1.7 billion yen, close to $10.7 million, back to North Korea. Five malware families showed up in the campaign, with names like BeaverTail and InvisibleFerret, delivered through npm packages and Visual Studio Code projects.

The people targeted were web designers, engineers and crypto specialists, but the trick itself needs no technical skill to fall for. Some victims were told their camera was playing up during the interview and were talked through a "fix" that was really a command to paste and run. Others just opened the take-home assignment. What came off those machines went well past wallets: passwords, clipboard contents, keystrokes and photographs of identity documents. The advisory notes those stolen IDs get reused, so North Korean IT workers can pose as real people when they apply for jobs abroad.

The defence here is unglamorous. Nothing a stranger sends you during a hiring process should run on the computer you bank on, and no genuine recruiter needs you to paste a command into a terminal to fix a webcam. A real coding test can wait until you have confirmed the company exists through a phone number or address you found yourself. If you think you already ran something you should not have, Tendvane's safety check lists what is installed and what starts up with Windows, which is where this sort of thing tends to settle in.