Nation-stateSep 21, 2026

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

North Korean actors compromised 30,000 devices, stealing $10.71M in crypto via job scam.

North Korean threat actors, operating under the 'Contagious Interview' campaign, have compromised over 30,000 devices globally, stealing at least $10.71 million in cryptocurrency. The campaign targets web designers, engineers, and crypto specialists by posing as recruiters on social media, leading victims through a fake job assessment that deploys malware.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

The lesson from this incident

Full lesson

The 'Contagious Interview' campaign exploited human trust and professional ambition by impersonating recruiters on social media platforms, luring victims into executing malware disguised as a legitimate job assessment. The root failure is a lack of security awareness among targeted professionals — web designers, engineers, and crypto specialists — who did not scrutinize the authenticity of recruitment contacts or the software they were asked to run. This is also a supply chain risk, as compromising individual contributors can cascade into broader organizational breaches. With 30,000 devices compromised and over $10 million stolen, the scale demonstrates that social engineering remains one of the most effective and underestimated attack vectors. Organizations must treat unsolicited recruitment activity as a potential threat vector and train employees accordingly.

What helps against this

How we list vendors

Palo Alto Networks research

Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
For exampleOkta Identity Threat Protection Acalvio ShadowPlex Identity Protection Huntress Managed ITDR all options
Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
For exampleMicrosoft Defender for Endpoint WithSecure Elements XDR ESET PROTECT all options
Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
For exampleHuntress Managed Security Awareness Training KnowBe4 Security Awareness Training SoSafe Awareness Platform all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — BeaverTail
malware — InvisibleFerret
malware — FlexibleFerret
malware — GolangGhost
malware — PylangGhost
malware — OtterCookie
malware — RATatouille
malware — OtterCandy
malware — StoatWaffle

Entities

WaterPlum (threat_actor)PurpleDelta (threat_actor)Wagemole (threat_actor)Famous Chollima (threat_actor)Void Dokkaebi (threat_actor)Gwisin Gang (threat_actor)