North Korean Fake Recruiters Target Developers With Trojanized Coding Tests
Malware Intelligence · 8 sources · Updated 2mo ago · First seen Jul 16, 2026
A North Korea-aligned campaign tracked as DeceptiveDevelopment has used fake recruiter personas and trojanized coding challenges on GitHub, GitLab, and Bitbucket to compromise freelance software developers. Active since at least November 2023, the operation has particularly targeted developers working on cryptocurrency and decentralized-finance projects, with hundreds of victims identified globally across Windows, Linux, and macOS.
Victims who run the malicious challenge receive the BeaverTail infostealer and downloader, followed by the Python-based InvisibleFerret backdoor. The malware steals cryptocurrency wallets, browser credentials, password-manager data, and other sensitive information; newer versions add Telegram exfiltration, selective clipboard theft, and keylogging, and can deploy AnyDesk for persistent remote access. The activity is linked to North Korean IT-worker and recruiter impersonation operations and overlaps with tactics associated with the Famous Chollima ecosystem and related DPRK campaigns.
