MalwarePublished 26 Nov 2025Updated 26 Dec 2025

Inside DPRK's Fake Job Platform Targeting U.S. AI Talent

Source AlienVault OTX General

Description

This analysis details a sophisticated DPRK-linked operation called Contagious Interview, which uses a fake job platform to target U.S. AI talent. The campaign mimics legitimate recruitment processes, offering job listings from well-known tech companies to lure victims. The platform, hosted at lenvny[.]com, is designed to appear as a legitimate AI-powered interview tool. It employs various techniques to establish credibility, including professional design, fake testimonials, and comparisons with real companies. The attack culminates in a malware delivery through a clipboard hijacking technique, triggered when victims attempt to record a video introduction. This operation specifically targets high-value professionals in AI and cryptocurrency sectors, aiming to gain access to strategic information and financial assets.

Impact

For European organizations, especially those involved in AI research, development, and cryptocurrency, this threat poses a significant risk of intellectual property theft and financial loss. Compromise of AI talent could lead to exposure of proprietary algorithms, research data, and strategic plans, undermining competitive advantage and national technological leadership. Cryptocurrency professionals targeted could suffer direct financial theft or loss of wallet credentials. The social engineering approach increases the risk of insider threats and credential compromise, potentially enabling broader network infiltration. Given the global nature of AI and crypto sectors, European professionals may be targeted either directly or via collaboration with U.S. entities. The malware’s persistence and obfuscation techniques complicate detection and remediation, potentially leading to prolonged unauthorized access and data exfiltration. The medium severity rating reflects the targeted scope and complexity, but the potential impact on confidentiality and financial assets is substantial.

Defensive guidance

European organizations should implement targeted awareness training focused on sophisticated social engineering tactics used in recruitment scams, emphasizing verification of job platforms and interview processes. Deploy endpoint detection and response (EDR) solutions capable of identifying clipboard hijacking and suspicious scripting activities. Monitor network traffic for connections to known malicious IPs and domains associated with this campaign (e.g., lenvny.com, advisorflux.com). Enforce strict application control policies to prevent execution of unauthorized scripts and binaries. Use multi-factor authentication (MFA) and credential monitoring to detect and block compromised accounts. Establish incident response playbooks specific to recruitment-related phishing and malware delivery. Collaborate with threat intelligence sharing groups to receive timely updates on indicators of compromise. Encourage verification of job offers through official company channels and limit sharing of sensitive information during recruitment. Regularly audit registry run keys and startup items for unauthorized persistence mechanisms. Finally, maintain robust backup and recovery procedures to mitigate impact of potential data loss.

Indicators of compromise

Domains 4

advisorflux.com
assureeval.com
carrerlilla.com
lenvny.com

IP addresses 2

69.62.86.78
72.61.9.45

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Nov 2025, 10:19 UTC

MITRE ATT&CK techniques14 from threat tags

Technical details

Indicators of compromise

Domains 4

IP addresses 2

Community reviews

Related threats