North Korea's fake job interviews infected 30,000 devices

North Korea's deceptive recruitment practices have compromised over 30,000 devices and stolen more than $10 million, according to an international advisory. The cybercriminals, backed by the North Korean regime, impersonate recruiters and target web designers, engineers, and cryptocurrency specialists. During the bogus interview process, victims are asked to download files that install malware, granting the attackers remote access to their computers.

This allows the criminals to steal sensitive data, including cryptocurrency wallet information and personal documents, which supports the North Korean regime. The attackers also use stolen credentials to infiltrate corporate systems and steal intellectual property and trade secrets. The operation, known as WaterPlum, affects web designers, engineers, and cryptocurrency specialists.

Stolen IDs can be used to impersonate victims and generate foreign currency. The agencies suggest that organizations suspecting fraudulent North Korean IT workers launch a full forensic investigation and assume that sensitive data has been compromised.