Loading story…
Mandiant reported that North Korean threat actors used WhatsApp messages posing as job opportunities to target individuals with phishing lures designed to deliver malware. The campaign relied on social-engineering conversations that built trust with victims before directing them to malicious content, continuing a pattern of DPRK-linked operations that use fake recruiter outreach to compromise targets of intelligence interest.
The activity involved abuse of a PuTTY-related utility as part of the infection chain, indicating the attackers blended familiar administrative tooling with deceptive job-themed pretexts to reduce suspicion. The operation highlights how consumer messaging platforms, employment-themed phishing, and dual-use software can be combined to gain initial access while masking malicious behavior behind seemingly legitimate recruitment activity.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Mandiant published a blog post describing a North Korea-linked phishing campaign that used WhatsApp job opportunity lures and referenced a PuTTY utility. The publication marks the public disclosure of the campaign details in the provided reference.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean threat actors expanded beyond traditional espionage into large-scale cryptocurrency theft and intrusion campaigns, with research presented at Black Hat identifying **1,640 organizations in 57 countries** touched by the activity and roughly **700 to 800** showing clearly malicious compromise. Investigators said some intrusions reached **root-level access** on servers and **AWS accounts**, while attackers also abused third-party contractors to reach government, healthcare, and private-sector victims. The activity was linked broadly to DPRK operations including **Lazarus Group**, which researchers said continues to pair social engineering with crypto theft and laundering to generate revenue believed to support sanctions evasion and state priorities. Separate reporting tied the shift to specific DPRK espionage clusters now targeting crypto users and firms directly. **Konni** was described as moving from South Korea-focused Windows espionage to a global **macOS** campaign using fake recruiter or document lures, **AppleScript**, `LaunchAgents`, **TCC** abuse, and payloads including **FileRATClient** and an **EggShell** variant. **Kimsuky** was reported to have operated a fake trading platform, **Tralert FX**, distributing a trojanized desktop app through direct download and the Microsoft Store before deploying a customized **Xeno RAT** via GitLab staging; researchers said that campaign affected more than **250 victim IPs across 28 countries**.
Aug 25, 2026
An international advisory from Australian, German, Japanese, and US agencies says the North Korea-linked **WaterPlum** campaign has infected more than 30,000 devices, compromised over 7,000 cryptocurrency wallets, and stolen at least $10.71 million. Operators posing as recruiters target engineers, web designers, and cryptocurrency/Web3 professionals with fraudulent interviews and coding assignments that deploy backdoors, remote-access trojans, and information stealers. Stolen credentials and identity data can support cryptocurrency theft, espionage, extortion, corporate intrusion, and fraudulent North Korean IT-worker activity. SentinelOne separately found DPRK-aligned **TraderTraitor** expanding the same job-lure tradecraft beyond cryptocurrency targets, compromising an Indian IT services provider through a weaponized Terraform repository. A typosquatted provider registry referenced in `.terraform.lock.hcl` enabled malicious modules to execute when a DevOps engineer ran Terraform; the engineer's Apple Silicon MacBook was subsequently infected with the **FLATROOF** and **ROOFDECK** macOS backdoors. The implants enabled credential theft, persistent remote command execution, reconnaissance, file transfer, and lateral movement, underscoring that developer endpoints with cloud, source-control, and CI/CD access are high-value targets regardless of their employer's industry.
Sep 25, 2026
North Korea-linked operators tracked as **HexagonalRodent**, **Contagious Interview**, and overlaps of **Lazarus/Famous Chollima** used fake recruiter outreach on LinkedIn and sham company infrastructure to lure software and Web3 developers into opening malicious coding assessments. Researchers said the campaign delivered malware including **BeaverTail**, **InvisibleFerret**, and **OtterCookie** through backdoored GitHub repositories, rogue npm content, malicious VS Code `tasks.json` execution, and weaponized Git hooks such as `pre-commit` and `post-checkout`. The malware targeted Windows, macOS, and Linux systems, stealing browser credentials, keychains, wallet data, seed phrases, and developer secrets while maintaining persistence and remote access.
Aug 14, 2026