North Korean Hackers Target Crypto Job Seekers With New Malware Attack

Highlights:

• North Korea-linked hackers are using fake crypto job offers on LinkedIn to trick developers into downloading malware.
• Hackers invite job seekers into private code repositories and hide malicious software inside fake coding assignments.
• Security researchers warn that these attacks could expose passwords, cryptocurrency wallets, and other sensitive account information.

North Korea-linked hackers are using fake cryptocurrency job offers to trick developers into downloading malware through private code repositories, according to security researchers. The attackers approach potential candidates on LinkedIn, invite them to complete a coding task and direct them to software that can install malicious files on their computers.

According to a Digital Asset report, OpenSourceMalware co-founder Paul McCarty described the technique during an October 21 episode of The OpenSourceMalware Show. The method is a new variation of the “Contagious Interview” campaign. Researchers have not disclosed how many people were affected or whether this method stole any cryptocurrency.

据 Digital Asset 报道，安全平台 OpenSourceMalware 在 10 月 21 日的节目中披露，朝鲜关联黑客组织使用名为 Contagious Interview 的攻击手法，以加密行业招聘为诱饵，通过 LinkedIn 联系求职者，并邀请其访问私有代码仓库、安装开发任务所需的软件包。攻击者在仓库中设置 .npmrc 配置文件，使 npm…

— 吴说区块链 (@wublockchain12) October 23, 2026

How Fake Crypto Job Interviews Work

The attack begins with a message from someone claiming to recruit for a crypto-related position. After a candidate expresses interest, the supposed recruiter invites them into a private code repository, a place where developers store software projects.

The candidate is then asked to download the project and install its required packages as part of a technical assessment. Such tasks are common in legitimate developer interviews, so the request can seem routine. However, the project contains a configuration file that changes where the computer downloads some of its software. If the candidate runs the installation command, the system may retrieve malicious code from a separate source.

McCarty said the attackers were still approaching potential targets through LinkedIn and offering digital asset jobs. The private repository then provides the settings needed to make the dangerous software available during installation.

Hackers Use Private Software Repositories to Hide Malware

The trick centres on a file called .npmrc, which controls how npm, a popular JavaScript package manager, finds and downloads software. Ordinarily, npm searches a public registry for packages. In the reported attack, the .npmrc file directs it to another registry for a particular dependency. The malicious package may not appear when researchers search the usual public source.

That difference complicates security checks. A package inspected on its own can look harmless or incomplete because the dangerous component comes from somewhere else. The harmful code may only become available when the targeted developer follows the full interview instructions. McCarty also said attackers were increasingly splitting malicious functions across several packages, making individual components harder to identify as threats.

Security Researchers Warn Crypto Developers

The latest findings build on earlier warnings about Contagious Interview, a campaign widely attributed to North Korean threat actors. In a September 21 report, software company Atlassian said attackers had created convincing recruiter profiles, company websites and coding projects to deceive applicants. Its researchers found that malicious projects could steal passwords, cryptocurrency wallet data and access tokens if executed.

Atlassian said it had removed hundreds of linked repositories and accounts as part of its response. Developers should be careful when asked to download software during online job interviews, especially if they have crypto wallets or sensitive information on their computers.

OpenSourceMalware has not identified specific victims, affected companies or wallet losses tied to the newly described technique.