North Korean Threat Actors Leverage Fake IT Worker Campaigns and Contagious Interview Tactics
North Korean nation-state threat actors have conducted a two-part operation, posing as job recruiters and embedding fake employees within legitimate companies.
North Korean nation-state threat actors have conducted a two-part operation, posing as job recruiters and embedding fake employees within legitimate companies.
Since at least 2022, these actors have deceived software developers into executing malicious code during simulated technical interviews. The malware families, BeaverTail and OtterCookie, are employed to steal credentials, gain remote control over devices, and conduct financial and identity theft.
The operation, known publicly as Contagious Interview, has affected thousands of developers and is expanding in scale.
Threat actors create convincing recruiter profiles on professional networking platforms and instruct targets to execute code under the guise of a technical task. Once the code is executed, the malware operates silently in the background.
Since at least 2022, these actors have deceived software developers into executing malicious code during simulated technical interviews.
Additionally, separate North Korean operatives have infiltrated Western technology firms as fraudulent employees, reportedly using earnings to support the regime. GitLab analysts identified and banned 131 accounts on GitLab.com in 2025 connected to these malware distribution campaigns. Activity peaked in September with an average of 11 account bans per month. Malware was not directly stored on GitLab but was instead fetched via a hidden loader from third-party services like Vercel, complicating detection efforts.
Analysts uncovered a private repository linked to a cell manager named Kil-Nam Kang, overseeing seven North Korean operatives in Beijing. Financial records indicate the cell earned over US$1.64 million between Q1 2022 and Q3 2025 through freelance software development under false identities.
Malware Execution and Concealment Tactics
The most common execution pattern in 2025 involved spreading malicious code across multiple project files, making it difficult to detect even during thorough code reviews. Threat actors encoded a staging URL inside a .env file, disguised as a regular configuration variable. When executed, a trigger function retrieved remote content, executing it as live code. Staging URLs returned decoy content unless correct request headers were used, adding a layer of protection against analysis.
In December 2025, a new cluster was observed executing malware through VS Code task configurations, decoding hidden payloads from fake font files.
Treat job applicants with broken links to professional profiles or code portfolios as suspicious. Developers should avoid executing unfamiliar code from unknown contacts during technical screenings. Security teams should monitor for encoded values in .env files and unexpected outbound requests triggered at application startup.
Based on reporting by Cyber Security News.