ESET researchers have observed a cluster of North Korea-aligned activities that they named DeceptiveDevelopment and where its operators pose as headhunters and serve their targets with software projec...

ESET researchers have observed a cluster of North Korea-aligned activities that they named DeceptiveDevelopment and where its operators pose as headhunters and serve their targets with software projec...

ESET, DeceptiveDevelopment grubunun sahte iş teklifleriyle kripto hırsızlıklarını inceledi. Sahte İş Teklifleriyle Kripto Para Tuzağı!

VB2025 presentation: DeceptiveDevelopment and North Korean IT workers: from primitive crypto theft to sophisticated AI-based deception, Matej Havranek

Indicators of Compromises (IOC) of our various investigations - eset/malware-ioc

ESET researchers have observed a cluster of North Korea-aligned activities that they named DeceptiveDevelopment and where its operators pose as headhunters and serve their targets with software projec...

ESET Research has released new findings on DeceptiveDevelopment, also known as Contagious Interview – a threat group aligned with North Korea that has grown increasingly active in recent years. The group is primarily focused on cryptocurrency theft, targeting freelance developers across Windows, Linux, and macOS platforms. The newly published research paper traces the group's evolution from early malware families to more advanced toolsets.

ReversingLabs YARA Rules. Contribute to reversinglabs/reversinglabs-yara-rules development by creating an account on GitHub.

North Korean hackers are targeting open source software developers with a backdoor and an information stealer as part of a broad supply chain campaign dubbed PolinRider.

North Korean threat actors behind the ongoing Contagious Interview campaign have been observed dropping a new JavaScript malware called OtterCookie. Contagious Interview (aka DeceptiveDevelopment) refers to a persistent attack campaign that employs social engineering lures, with the hacking crew often posing as recruiters to trick individuals looking for potential job opportunities into

North Korean hackers use fake job interviews on Upwork and GitHub to infect crypto developers with BeaverTail and InvisibleFerret malware, stealing cr

A North Korea-aligned cybercriminal campaign dubbed DeceptiveDevelopment has been targeting freelance software developers through fake job interviews since early 2024. Posing as recruiters on platforms like LinkedIn, Upwork, and cryptocurrency-focused job boards, attackers lure victims with promising job opportunities or lucrative freelance projects. The ultimate goal is to trick developers into executing trojanized codebases that deploy malware designed to steal cryptocurrency wallet data, browser credentials, and sensitive system information. Researchers identified two primary malware families in this campaign: BeaverTail, an infostealer and downloader, and InvisibleFerret, a modular backdoor enabling remote access and data exfiltration. These tools are remain hidden within software projects that victims are asked to review or modify as part of a fake hiring challenge. Notably, the attackers exploit GitHub’s interface by appending malicious code after long comments, pushing it off-screen in the default editor view. Malicious code appended after a long comment pushing it off-screen in GitHub’s code editor (top) and the page source of just line #1 (Source – ESET) ESET researchers noted that this obfuscation technique increases the likelihood of victims unknowingly executing the malware. Technical Delivery: Hidden Code and Obfuscation The attackers’ reliance on social engineering is complemented by sophisticated technical tactics. BeaverTail, delivered as JavaScript or Qt-based executables, begins by decrypting hardcoded Command-and-Control (C&C) server details. For example, the IP address 147.124.214.237:1244 is split into base64-encoded fragments and rearranged to evade detection :- javascript host="yNDEuMjA4MTg1LjIzNS4" // Decoded to 147.124.214.237 via string manipulation DeceptiveDevelopment compromise chain (Source – ESET) Once executed, BeaverTail searches for browser extensions like MetaMask, Coinbase Wallet, and Phantom to exfiltrate cryptocurrency keys stored in id.json (Solana) or browser databases. It also harvests login credentials from Firefox, Chrome, and system keychains. InvisibleFerret, the second-stage payload, uses XOR encryption and modular Python scripts to maintain persistence. One sample decrypts its payload using a hardcoded key ( G01d*8@( ) and establishes a reverse shell for remote command execution. Browser credential decryption logic in InvisibleFerret (Source – ESET) The malware’s browser module targets Chrome, Brave, and Edge profiles to extract encrypted credentials, leveraging OS-specific decryption methods—such as win32crypt on Windows or secretstorage on Linux—to decode sensitive data. The campaign’s infrastructure relies on servers hosted by providers like RouterHosting and Majestic Hosting Solutions . C&C communication occurs over non-standard ports (1244, 3000) to blend with legitimate traffic. Recent updates to InvisibleFerret include FTP-based data exfiltration and integration with Telegram’s API for real-time credential theft, signaling evolving operational sophistication. Developers are advised to verify recruiter identities, avoid executing unsolicited projects, and monitor for anomalous network activity on ports 1224–1245. Collect Threat Intelligence on the Latest Malware and Phishing Attacks with ANY.RUN TI Lookup ->  Try for free The post Beware of Fake Job Interview Challenges Attacking Developers To Deliver Malware appeared first on Cyber Security News .