Contagious Interview · One Interview Away From Infection

A sophisticated global campaign targets software developers with fake job interviews via a fraudulent company called AccuraSoftHire. The attackers use legitimate job platforms and verified LinkedIn profiles to lure candidates, delivering malicious npm packages disguised as Tailwind CSS plugins in take-home coding assignments. These packages deploy loaders that fetch additional malware payloads using blockchain dead drops. The campaign also distributes a fake camera driver from the company's career site to deliver malware. Linked to North Korean threat actors, this operation has infected tens of thousands of machines and caused significant cryptocurrency theft, including the Binance breach exceeding six billion dollars.

• Summary of Malicious Program Distribution via Goddess of Victory: NIKKE PC LauncherMalware2026-11-05
• Binance heist: what we know, and what we see in TraderTraitor's toolkitMalware2026-11-05
• Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party ScriptCampaign2026-10-30
• A new version of the MacSync macOS stealer targets crypto enthusiasts and developersMalware2026-09-24
• Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines CryptoMalware2026-11-06