North Korean hiring scams are attacks that use the hiring process to get inside companies. Fake recruiters pose as employers and get employees to run malware during a fake job interview, and fake candidates are North Korean operatives who get hired into real remote jobs under stolen identities.
A September 2026 joint advisory from agencies in Japan, the US, Australia and Germany says the fake-recruiter campaign tracked as WaterPlum infected at least 30,000 devices in more than 100 countries between roughly December 2025 and July 2026, and that the fake recruiters and some of the fake IT workers operate under the same North Korean unit. Both attacks start as ordinary hiring conversations, so they belong in awareness training for the employees who get approached and for the HR staff who hire.
How the fake recruiter attack works
- The attackers search LinkedIn and job sites for people with privileged access, often trying dozens of employees at one company. Developers are the usual targets, but in 2025 the security firm Sekoia found the lures had spread to non-technical roles such as business development and product.
- They pose as a real AI or crypto company, or an invented one with a polished website, and make contact through LinkedIn, job boards or freelance marketplaces.
- They run a believable hiring process: usually an HR call, then a “CEO” or technical lead, on live video.
- They get the candidate to run something: a take-home coding test, a GitHub repository or NPM package to “review”, an offer PDF, or a command to fix a broken camera on the interview site.
- The code installs infostealers and backdoors that collect passwords, session cookies, crypto wallet keys and ID scans. On a work laptop, that opens a route into the employer, its clients and suppliers.
How the fake IT worker scheme works
The operative applies, often through staffing firms or freelance platforms, with a real person’s stolen identity, an AI-altered photo and fake personas as references. The company laptop then goes to a facilitator’s home, a so-called laptop farm. The worker connects from North Korea, China or Russia, so the employer sees a local IP address.
Wages pass through the facilitators to the North Korean workers. Some also steal defence data or crypto, and some who are caught hold source code hostage or deface the company website.
Why it works on people
- The request looks normal. Developers do take-home tests, and candidates don’t expect the recruiter to be the attacker.
- The pay is high. CoinsPaid staff were offered $16,000 to $24,000 a month.
- Candidates keep job hunting quiet. Many interview without telling anyone at work, sometimes on the work laptop, so they may not ask the security team to check a coding test.
- Typos no longer give it away. Fireblocks’ CEO told CNBC that approaches once full of typos now read like Oxford graduates wrote them. Some interviews use AI face-swapping.
- Remote hiring relies on documents. A valid stolen identity passes a background check, and the candidate may never be met in person.
Tell-tale signs
Fake recruiter (for every employee):
- any request to download and run code, a package or a repository
- a camera or microphone “fix” that means running a command or installing a driver
- the interviewer’s video dropping after a few minutes “due to network issues”
- an unsolicited, unusually generous offer
Fake candidate (for HR and hiring managers):
- refusal to meet in person, or video that keeps freezing
- a laptop shipping address that differs from the home address
- bank details that change during onboarding
- VoIP numbers, email-only references, little digital footprint
- no real grasp of the skills on the CV
- after hire, remote-access tools or logins from several countries in a short time
North Korean hiring scam examples
Binance, 2026 (crypto exchange; fake recruiter).
In September 2026 a software engineer was approached on a legitimate job platform by the “Project Director” of a company that did not exist. Two interviews later he downloaded a coding assignment onto his work laptop. Its custom malware slipped past endpoint protection. From that laptop the attackers compromised two more wallet engineers, then, by 29 October, the wallet-signing service. About $6.34 billion in crypto assets was affected, about $2.85 billion of which was frozen or intercepted by 3 November. Takeaway: interview code never runs on a work device. BleepingComputer
KnowBe4, 2024 (security awareness training, US; fake IT worker).
KnowBe4 hired an engineer who passed four video interviews, a background check and reference checks with a valid stolen US identity. As soon as the company Mac arrived it began loading malware; the hire claimed he was fixing his router. The SOC contained it in about 25 minutes; no data was lost. Takeaway: HR checks alone don’t catch this, so new starters begin with limited access. KnowBe4
Axie Infinity, 2022 (Sky Mavis, crypto gaming; fake recruiter).
A senior engineer opened a generous job offer PDF after several interview rounds, letting in spyware that led to a $540 million theft. Sky Mavis confirmed only a spear-phishing compromise; the job-offer detail comes from The Block’s sources. Takeaway: a job offer is an attachment like any other. The Block
The Arizona laptop farm, 2020–2023 (many sectors, US; fake IT worker).
Christina Chapman kept company laptops in her home so North Korean workers using 68 stolen US identities appeared US-based. The scheme hit 309 US businesses, including a top-five TV network and an aerospace manufacturer, and she was sentenced to 102 months in 2025. Takeaway: ordinary companies hiring through staffing agencies are targets too. US Department of Justice
Spanish aerospace company, 2022 (aerospace, Spain; fake recruiter).
North Korea’s Lazarus group posed as a Meta recruiter on LinkedIn and sent two “coding challenges”: a Hello World program and a Fibonacci printer. Running them on a company device installed a new espionage backdoor. Takeaway: Lazarus goes after intellectual property outside crypto too, and borrows famous brands as cover. ESET
CoinsPaid, 2023 (crypto payments, Estonia; fake recruiter).
After six months of probing that included fake job offers and bribes, an employee who believed he was interviewing at Crypto.com downloaded “a technical test” that gave the attackers access. They took $37 million. Takeaway: odd approaches that seem to go nowhere may be reconnaissance, so report them. DL News
California defence contractor, 2024 (defence, US; fake IT worker).
North Korean IT workers got hired through a US facilitator network, and a co-conspirator abroad remotely opened export-controlled defence files. Takeaway: export-controlled and other sensitive files need access controls beyond a standard employee login. US Department of Justice
How to prevent North Korean hiring scams
Personal habits to prevent North Korean hiring scams
- Keep interview tasks, coding tests and offer documents off work devices, and use a personal machine for job hunting.
- Walk away from any interview that needs a command run or a driver installed to fix a camera. No real interview does.
- Report odd recruiter approaches, even ones that were turned down.
Security controls to prevent North Korean hiring scams
- Have HR verify the person as well as the documents: check identity on live video, compare the laptop shipping address with the home address, and phone references.