Threats Tagged 'fake job interviews'

A DPRK-aligned threat group is conducting a supply chain malware campaign targeting software developers through fake job postings and coding challenges. The attackers distribute trojanized repositories containing legitimate e-commerce projects with malicious code hidden via steganography inside SVG flag images. When executed, the malware deploys a four-stage payload including a browser credential and cryptocurrency wallet stealer, file exfiltration, a remote access trojan, and a clipboard stealer. The campaign was discovered after targeting Elastic's community Slack workspace. Multiple trojanized repositories initially evaded antivirus detection, highlighting the sophistication of this attack vector.