North Korea Hiring Scams: Fake Interviews and Coding Tests

Video transcript

The job looks real, right up to the take-home coding test. Running that test is the attack.

Unit 42 links this campaign, with moderate confidence, to North Korea. A recruiter makes the approach, interviews build trust, then comes a task to run, and the payload.

The stealer BeaverTail grabs wallets and saved logins, then loads InvisibleFerret, a backdoor that logs keystrokes and steals files.

One Socket report counted 35 malicious npm packages, some posing as real libraries.

Tricks include install-time loaders, code hidden off-screen, and deadlines too short to read.

Binance says a fake job assignment was one step in its October 29 incident. Endpoint tools missed it, and the attacker later reached a signing service.

Stop if they ask you to run their code, use your work laptop, rush a deadline, turn off Docker, or install software for the call.

Do tests in a disposable virtual machine on a non-company device, with no wallets or keys. Read every dependency before installing.

If you ran it, disconnect the device but leave it on. From a clean device, move funds and rotate every key. Then tell your security team and report it to the FBI.

Guardian's OpSec Audit maps every path from one laptop to your funds. Read the full guide, or talk to Guardian.

The job looks real: a recruiter, a video interview, then a take-home coding test. Running that test is the attack.

Researchers track the campaign under names like Contagious Interview. This guide covers how it works, what to look for, and what to do if you ran the code.

How the Scam Works

Palo Alto Networks' Unit 42 named the campaign Contagious Interview in November 2023. It says, with moderate confidence, that a North Korean state-sponsored actor runs it.

ESET tracks overlapping activity as DeceptiveDevelopment. It calls the cluster North Korea-aligned "with high confidence".

The steps rarely change:

1. The approach: a "recruiter" messages a developer on LinkedIn, a job board or a freelance site.
2. The interview: one or more calls build trust and make the job feel real.
3. The task: the developer is asked to run a repo, an npm package or a "video call app".
4. The payload: the code installs a stealer, which fetches a backdoor.

ESET lists LinkedIn, Upwork, Freelancer.com and Crypto Jobs List among the platforms used. The FBI says North Korean actors usually communicate in fluent or nearly fluent English, and know crypto well.

The malware

Unit 42 says both BeaverTail and InvisibleFerret run on Windows, macOS and Linux. Targeted wallets include MetaMask, Coinbase Wallet, Phantom and Rabby.

The bigger prize is often the employer. TRM Labs calls North Korea's route from a coding test to signing systems "Code to Custody."

The Binance Case

Binance's November 3, 2026 initial report describes a fake job test as one step in its October 29 incident. In its account:

• In September, someone "posing as a Project Director" contacted a software engineer on a legitimate job platform.
• After two interview rounds, he was told to download an "assignment" to his work computer.
• Its code "executed during the setup process." Endpoint tools did not detect it at the time.
• In October, the attacker moved to other engineers and, on October 29, reached a wallet signing service.

Binance's report ties the case to no named campaign. It says the attacker had also compromised another engineer in June, through a tampered Homebrew download.

TRM Labs and the FBI attribute the theft to North Korea's TraderTraitor unit, which North Korea denies. Our Binance hack explainer covers the full timeline.

Malicious Repos and Packages

The code is built to survive a quick look. Researchers have documented these tricks:

One Socket report counted 35 malicious npm packages from 24 accounts. The six still live had been downloaded over 4,000 times.

Several mimic real libraries: Socket says reactbootstraps poses as react-bootstrap.

Recruiters also talk developers out of their defenses. Socket says they press victims to "disable Docker or other container environments" and run the code while screen sharing.

Warning Signs

Stop if the test asks for any of these:

• Running their repo, package or script, not just reading it (FBI).
• Doing it on your work laptop (FBI).
• Finishing in a time limit too short to read the code (Kaspersky).
• Turning off Docker, or running it while screen sharing (Socket).
• Installing custom software just for the call (FBI).

The FBI's September 2024 warning also flags unrealistically high pay offered without negotiation.

Some attackers skip the test and send a meeting link instead. See fake Zoom meeting scams.

Safe Review Practices

For developers

• Never run an unknown repo on a work device, or on any machine with wallets or keys.
• Use a disposable VM on a non-company device, as the FBI advises, or a device the tester provides.
• Keep that VM empty: no wallets, SSH keys, cloud logins or browser sessions.
• Read the package.json scripts and every dependency before you install.
• Turn on word wrap, so nothing hides past the edge of the screen.
• Refuse to disable containers, rush a deadline or run code while screen sharing.
• Keep seed phrases and wallet logins off internet-connected devices, per the FBI.

For companies

Assume someone on the team will take an outside test. Make these the rules:

• Isolation: outside code runs only in a sandbox VM, never on a work device.
• EDR: on every engineer's laptop, with alerts someone answers around the clock.
• Allowlisting: where you hold large amounts of crypto, the FBI advises running only approved programs.
• Least privilege: keep deploy tokens and signing access off daily laptops.
• Hiring rules: verify recruiters on a separate channel, and report approaches without blame.

EDR is a layer, not a guarantee: Binance's tools missed its malware. Binance also says the attacker found a container deployment token on another engineer's computer.

Device and account baselines are in our crypto OpSec guide. When you hire, the threat runs the other way: see how to spot North Korean IT workers.

If You Ran It

Move fast and assume the worst. SEAL's playbook treats a confirmed compromise as "full credential and key theft."

1. Disconnect the device from the internet but leave it on, as the FBI advises.
2. From a clean device, move funds out of every wallet the machine touched.
3. Rotate everything reachable from it: SSH keys, cloud and deploy tokens, API keys, passwords.
4. Sign out of every session, including email, GitHub, Telegram and exchanges.
5. Tell your security team now, even if it was a personal laptop.
6. Warn your contacts: SEAL says attackers may impersonate you to reach them.
7. Report it to the FBI at IC3.gov, with screenshots and the recruiter's details.

If you sign for a multisig, stop signing and alert the other signers. Our guide to social engineering of multisig signers covers the rest.

How Guardian Helps

Guardian's OpSec Audit maps every path to your funds. It covers access across every system, secrets handling, and how joiners and leavers are handled.

Its infrastructure pentest treats your cloud footprint "as a set of accounts to escalate through until something signs."

Managed Security adds monitoring. Offchain, Guardian's Sentry watches your domains, DNS, certificates, cloud and code host.

When something fires, a Guardian engineer responds, around the clock.

Frequently Asked Questions

What is the Contagious Interview campaign?

It is Unit 42's name for a campaign in which fake recruiters get developers to run malicious code during job interviews. It delivers BeaverTail and InvisibleFerret. Unit 42 attributes it to a North Korean state-sponsored actor with moderate confidence.

Is it safe to do a take-home coding test?

Only in isolation. Run it in a disposable virtual machine on a non-company device, as the FBI advises, with no wallets, keys or saved logins. Never disable containers or run it while screen sharing because a recruiter asks.

What do BeaverTail and InvisibleFerret steal?

BeaverTail steals crypto wallet and login data from browsers, then loads InvisibleFerret. That Python backdoor logs keystrokes, runs remote commands, steals files and can install AnyDesk, according to Unit 42 and ESET.

What should I do if I ran a recruiter's code?

Disconnect the device but leave it on, as the FBI advises. From a clean device, move funds and rotate every key, token and password the machine held. Then tell your security team and report it at IC3.gov.

Sources

• TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (October 29, 2026)
• BleepingComputer: FBI links $6.3 billion Binance crypto heist to North Korean hackers (November 1, 2026)
• TRM Labs: North Korea Has Stolen USD 12.8 Billion in Crypto, USD 7.4 Billion of It in 2026 (October 30, 2026)
• Palo Alto Networks Unit 42: Hacking Employers and Seeking Employment, Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors (November 21, 2023)
• Palo Alto Networks Unit 42: Contagious Interview, DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware (October 9, 2024)
• ESET WeLiveSecurity: DeceptiveDevelopment targets freelance developers (February 20, 2025)
• Socket: Another Wave, North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages (June 25, 2025)
• Kaspersky Securelist: Crypto wasted, BlueNoroff's ghost mirage of funding and jobs (October 28, 2025)
• FBI (IC3): North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks (September 3, 2024)
• Binance: 29 October 2026 Binance Security Incident, Initial Findings and Response Update (November 3, 2026)
• SEAL Frameworks: North Korea (DPRK) Attack Response
• Guardian: OpSec Audit
• Guardian: Infrastructure Pentest
• Guardian: Managed Security