Хочете будувати кар’єру в Data Science та AI? Vodafone Big Data Lab відкриває новий набір —>
Наталя ХандусенкоHot News
21 September 2026, 14:52
2026-09-21
North Korean hackers infected 30,000 devices with fake test tasks and stole $10 million in cryptocurrency
North Korean cybercriminals are using fake job openings to infect IT professionals’ computers, steal cryptocurrency, and harvest data for further attacks. A joint investigation by law enforcement agencies in Australia, Germany, Japan, and the United States found that more than 30,000 devices and more than 7,000 cryptocurrency wallets were compromised in the campaign. The total losses are estimated at at least $10.71 million, which was used to fund the North Korean regime.
North Korean cybercriminals are using fake job openings to infect IT professionals’ computers, steal cryptocurrency, and harvest data for further attacks. A joint investigation by law enforcement agencies in Australia, Germany, Japan, and the United States found that more than 30,000 devices and more than 7,000 cryptocurrency wallets were compromised in the campaign. The total losses are estimated at at least $10.71 million, which was used to fund the North Korean regime.
International agencies have linked this activity to the WaterPlum hacking group. The main targets of the attackers are web designers, software developers, as well as specialists in the Web3 and cryptocurrency industries, TechSpot reports .
How the attack scheme works
The hacker poses as a company recruiter and contacts a specialist with a job offer.
During the interview, the candidate is sent a technical specification or code for testing.
The files contain malware. Once the downloaded file is opened, remote access tools and data-stealing programs are silently installed on the device.
The malicious software collects logins and passwords, clipboard data, keystrokes, access to crypto wallets, and also copies documents and trade secrets.
The danger threatens not only the personal safety of the specialist, but also his employer - if the infected computer is subsequently used to perform work tasks.
Part of a global $500 million per year scheme
Stolen identity documents are used by North Korean IT specialists to fake identities when applying for jobs abroad (in particular in the US and EU) to circumvent international sanctions.
Researchers estimate that there are about 100,000 North Korean IT professionals working or looking for work around the world. They use so-called “laptop farms” (accomplices leave devices in the US or Europe to simulate a local presence), and the salaries they receive are transferred to the DPRK state budget. This scheme brings North Korea more than $500 million annually.
What employers should pay attention to
Law enforcement officials say that attackers are increasingly using AI tools to face-swapping during video interviews. Suspicious signs include:
visual glitches in the video or the camera suddenly turning off immediately after the call starts;
an impressive resume that does not match the candidate's real knowledge at the interview;
Refusal of face-to-face meetings, regular "technical failures" during calls, or requests to receive salary in cryptocurrency.
If a fake employee is detected, companies are advised to immediately conduct a full forensic investigation and change all corporate passwords and accesses.
“What do you think of Kim Jong-un?” An IT recruiter suggests that North Korean IT professionals are applying for jobs in Europe under the guise of suspicious candidates from Asia. She uses a special screening question for such people
