Loading story…
DPRK-linked actors have evolved their ClickFix social engineering campaigns, now targeting marketing and trading roles in cryptocurrency and retail sectors with BeaverTail and InvisibleFerret malware. The latest wave features compiled malware variants and new delivery tactics, including fake hiring platforms and password-protected archives. This marks a tactical shift to reach less technical targets and adapt to takedown efforts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
A large-scale attack abusing GitHub Pages was reported as delivering stealer malware to macOS users. The campaign was highlighted as a significant malware distribution operation affecting Macs.
Threat reporting cited collaboration between the Gamaredon and Turla groups. The relationship was presented as a notable attribution and operational development.
CISA released a malware analysis report covering a malicious listener targeting Ivanti Endpoint Manager Mobile. The publication provided official technical details on the malware and its targeting.
Satori Threat Intelligence issued an alert concerning SlopAds fraud operations. The alert was included among the notable threat developments current as of the reporting date.
Researchers reported on a FileFix campaign that employed steganography as part of its attack chain. The use of hidden content for delivery or evasion was noted as a key technical detail.
Reporting described the spread of the Shai-hulud worm against npm packages. The activity was highlighted as part of a broader pattern of attacks abusing open-source software distribution channels.
A major software supply chain incident compromised the Tinycolor npm package along with more than 40 related packages. The event was identified as one of the most significant malware and ecosystem threats covered in the reporting.
Researchers highlighted new Mustang Panda (Hive0154) activity involving the Toneshell backdoor and the SnakeDisk USB worm. The campaigns were cited as a significant ongoing malware development.
Security reporting identified a resurgence of the SmokeLoader malware as a notable development. The renewed activity was included among the major malware trends observed as of late September 2025.
Reporting noted that the North Korean operators quickly replaced malicious infrastructure after takedowns, indicating an adaptive and resilient campaign. The shift was described as reflecting increased sophistication and stronger financially motivated targeting.
The DPRK-linked campaigns adopted ClickFix-style infection chains to deliver malware including BeaverTail, InvisibleFerret, CHILLYCHINO, and FadeStealer. Operators also used compiled payloads, password-protected archives, GitHub-hosted infrastructure, and deepfake-enabled social engineering to improve delivery and evasion.
North Korean threat actors, including Lazarus subgroups and Kimsuky/APT43, broadened fake job-themed campaigns from software developers to marketing and trading roles in cryptocurrency and retail sectors. The activity used social engineering through fake hiring platforms and spear-phishing to reach a wider victim pool.
3 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean threat actors linked to **Contagious Interview**, **Famous Chollima**, and **Lazarus** used fake job and hiring platforms to infect applicants with BeaverTail, InvisibleFerret, FlexibleFerret, FrostyFerret, GolangGhost, and related malware families. Researchers said the operation evolved from earlier job-themed campaigns into **ClickFix**-style social engineering, where victims were told to copy and paste OS-specific troubleshooting commands from bogus interview sites. The infrastructure collected visitor IP and geolocation data, checked for cryptocurrency wallet browser objects, and then delivered tailored payloads for **Windows**, **macOS**, and **Linux** through staged download chains and fake recruiter workflows. The campaign expanded beyond software developers to target **cryptocurrency**, **marketing**, and other less technical roles, reflecting a broader DPRK shift toward centralized finance and job seekers who may be less suspicious of recruiter outreach. Reports tied the activity to malicious repositories, dozens of weaponized **npm** packages, fake hiring domains such as `businesshire[.]top`, and backend infrastructure including `nvidiasdk.fly[.]dev`, while analysts also documented persistence via Run keys and LaunchAgents, password theft on macOS, and malware loaders designed to frustrate analysis through allowlists and low-volume testing. Security firms assessed the activity as an ongoing evolution of the long-running Contagious Interview operation rather than isolated incidents.
Aug 15, 2026
North Korea-aligned threat actors, tracked as DeceptiveDevelopment or Contagious Interview, have intensified campaigns targeting software developers in the cryptocurrency and Web3 sectors. These attackers use fake recruiter profiles and staged job interviews to deliver trojanized codebases and malware, including infostealers like BeaverTail, OtterCookie, WeaselStore, and the modular remote access tool InvisibleFerret. Recent research also uncovered a new backdoor, AkdoorTea, and additional tools such as TsunamiKit and Tropidoor, all deployed through sophisticated social engineering tactics across Windows, Linux, and macOS platforms. The group leverages platforms like LinkedIn, Upwork, and GitHub to lure victims, often instructing them to execute malicious scripts under the guise of coding assessments or technical troubleshooting. ESET's analysis links these operations to North Korean IT workers involved in fraudulent job schemes, highlighting the group's financial motives and broad operational scale.
Aug 14, 2026North Korean hackers are using the ClickFix social engineering tactic to target job seekers in the cryptocurrency sector with fake employment offers. Victims are lured to fraudulent websites and tricked into running malicious commands, resulting in malware deployment. Attackers frequently rotate infrastructure to evade detection, emphasizing the need for vigilance among job seekers.
Jun 29, 2026