Hackers use fake coding tests to infect 30,000 devices and steal $10 million in crypto
The agencies refer to the group behind the activity as WaterPlum. It targets web designers, software engineers and people working in cryptocurrency and Web3. The group contacts victims while posing as recruiters, then sends what appears to be a coding exercise or other technical test as part of the hiring... Read Entire Article
North Korean hackers have infected over 30,000 devices and stolen more than $10 million in cryptocurrency through fake coding tests and job offers, according to authorities in Australia, Germany, Japan, and the United States. The cybercriminal group, known as WaterPlum, targets web designers, software engineers, and individuals working in cryptocurrency and Web3.
They impersonate recruiters and send technical tests containing malware, which allows them to install remote-access tools and information stealers on the victim's computer. This gives them continuous access to the system after the supposed interview concludes. The malware can collect login credentials, clipboard data, keystrokes, cryptocurrency-wallet information, identity documents, and proprietary files, potentially compromising the victim's employer as well.
Stolen identity documents may enable North Korean IT workers to conceal their identities while seeking jobs abroad, generating foreign currency. The attackers could also use the stolen credentials to take cryptocurrency, access personal data, or obtain trade secrets from employers, clients, and contractors, which may be used in extortion attempts.
The campaign is part of a broader North Korean effort to generate money through remote IT work, employing fraudulent identities to secure jobs in sanctioned countries like the US. Some North Korean workers use laptop farms to make it appear they are working from their hired location, potentially earning more than $500 million annually for North Korea.
Companies should be wary of signs that a job candidate might be using a false identity, such as impressive résumés that don't match interview performance, refusal to meet in person, repeated technical issues during video calls, or requests to be paid in cryptocurrency. Authorities advise companies with suspicions to conduct a full forensic investigation, assuming that passwords, systems, and sensitive data may have been exposed.
Written by urgent.news from TechSpot's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
