Fake recruiter

November 8, 2026

• New profiling separates TraderTraitor from higher-volume job-lure crews. Security Alliance argues that TraderTraitor/Jade Sleet/UNC4899 uses fake interviews as an entry point but differs from Contagious Interview through careful target selection, multi-employee pressure and infrastructure-focused operations involving front-company repositories and trojanized Terraform providers. Binance still has not released meaningful technical indicators (earlier coverage). · Threat Activity & Operations

November 4, 2026

• Binance published a four-stage reconstruction of the $6.3 billion heist, and the new detail is the lateral movement. In September an engineer was approached on a job-hunting platform, run through two fake interviews, and told to pull a "coding assignment" from a code repository; the payload dropped a malicious pyenv_ into the macOS Homebrew directory, deleted the legitimate pyenv, re-pointed the symlink and spawned zsh, and went undetected by endpoint tooling at the time (BleepingComputer). On October 20 the attacker used that host plus an internal AI tool to take control of a Wallet DevOps engineer and a second wallet engineer, picking up a container deployment permission token that led to wallet-signing operations on October 29; Binance also notes that pausing withdrawals did not revoke malicious permissions already recorded on Ethereum (Binance incident report). The FBI attributes the intrusion to TraderTraitor / Lazarus; North Korea denies it (The Record) (earlier coverage) (discussion). · Threat Activity
• Chinese researchers describe a new Lazarus campaign dubbed "FlashHole" using AI-generated résumés as the lure, abusing banking security software for intrusion, running in memory, and using GitHub for C2 (report). · Nation-State & Espionage

November 1, 2026

• Yoba's loader hides behind legitimately signed AI installers. Check Point traces fake "AI" GitHub projects and SEO poisoning to ZIPs pairing a signed OpenAI/Anthropic Setup.exe with a malicious winmm.dll for sideloading, then launch/locale/admin checks and long sandbox delays, a masquerading scheduled task for persistence, and payload retrieval via a Telegram plus DNS-over-HTTPS domain-generation scheme. Observed payload is a Tor-based XMRig miner, but the framework can carry anything (Security Affairs); earlier coverage. · Threat Activity · also via seo poisoning

October 29, 2026

• MDM as an initial-access and persistence channel: Huntress is seeing attackers social-engineer users into enrolling devices in attacker-controlled Hexnode and Rippling tenants, then push rogue RMM. In one case a removed ScreenConnect agent reappeared hours later, reinstalled through the unauthorized MDM agent. Hunt for unexpected enrollments, management agents and external relay connections; remediation means removing the endpoint from the rogue tenant and revoking tokens, not just deleting the RMM (Huntress). · Threat Activity

October 14, 2026

• DoJ raided 40+ Texas residences and seized ~187 devices in Operation Lonestar Roundup (21–25 September), charging 14 people. US nationals Michael James Bostelle and Juan Cecilio Pena Carrillo allegedly helped North Korean workers earn over $3 million from about 70 US companies across 17 states, including healthcare, cybersecurity, retail and manufacturing firms (The Record, DoJ). · Threat Activity

October 7, 2026

• Iran-aligned CL-STA-1178 ran "Blinder Tunnel" against an Iraqi critical-infrastructure target, likely a software engineer. The lure was a fake Dubai Airports recruiter with an offline careers portal and HR questionnaire, followed by a Visual Studio "coding test" whose weaponised .csproj executes the moment the project is opened in the IDE — before any build — chaining into AppDomainManager hijacking (Unit 42). · Threat Activity

September 24, 2026

• Japan dismantles its first North Korean laptop farm. A joint international advisory ties the WaterPlum campaign to a global fake-employer scheme that infected more than 30,000 devices and stole $10.7 million in cryptocurrency (SecurityWeek) (earlier coverage). · Threat Activity

September 23, 2026

• Fake job-interview "coding assignments" are pushing DevOps engineers to run terraform init against typosquatted HashiCorp registries, pulling a malicious provider that drops the FLATROOF and ROOFDECK macOS backdoors and steals browser data, keychain secrets and cloud API keys before pivoting into AWS and GCP. SentinelOne ties the chain to the LayerZero/KelpDAO compromise and reports it resurfacing on an Indian IT-services engineer's Mac with no crypto exposure (SentinelOne Labs). · Supply Chain & Developer Tooling

September 19, 2026

• A five-country advisory names "WaterPlum" — FBI and DoD with Japan's National Police Agency and agencies in Australia and Germany. Between December 2025 and July 2026 the North Korean actors infected at least 30,000 devices across 100 countries, took funds or credentials from about 7,000 cryptocurrency wallets, and stole more than $10.5 million, luring web designers, engineers and crypto specialists into downloading files during fake interviews. Japanese police found BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle variants, with infostealers plus RMM tooling kept in place in the hope victims later get hired at target firms (The Record, The Register). · Threat Activity

September 5, 2026

• GOOP is live and iterating — malware masquerading as Babel on npm, delivered through fake job interviews (a Nike-branded front-end "project"), using Ethereum smart contracts for C2 resolution and updating its on-chain C2 mid-analysis; a parallel strand targets US trucking firms with VBS files posing as haul schedules (@vxunderground, trucking thread). Socket has described the campaign as DEV#POPPER-adjacent. · Supply Chain & Build Pipelines · also via package registry

September 2, 2026

• Denmark's CERT.dk warns of fake student CVs installing remote-access tooling on researcher machines — an academic-sector variant of the recruitment-lure pattern above, worth a hunt across university and research partners (CERT.dk). · Threat Activity

August 12, 2026

• Lazarus revived Operation Dream Job with a new Windows zero-day, delivering malicious PDFs via fake recruiters to exploit CVE-2026-68820 — the same afd.sys bug Microsoft patched this week — alongside CVE-2025-49113. Check Point traced a chain including a new in-memory backdoor, a kernel rootkit, and webshells against defense sectors in Europe and India (Check Point Research). Separately, ANY.RUN, BCA and NorthScan stood up a fake DeFi startup ("Blue Whale LTD") and knowingly hired suspected Famous Chollima operatives to observe DPRK IT-worker infiltration from the inside (ANY.RUN). · Threat Activity · also via phishing email

August 11, 2026

• CERT-UA warns of Sandworm subcluster UAC-0145 running fake-job social engineering against Ukrainian sysadmins. Posing as an IT firm (e.g. "ATLAS Business Group") on job boards, the actor studies a candidate's résumé before making contact — attribution ties to APT44/Seashell Blizzard (CERT-UA). · Threat Activity

July 28, 2026

• JUMPSEC dissected a BlueNoroff (DPRK/Lazarus) ClickFix malware kit that abuses hijacked Telegram accounts and fake meetings to target high-value victims, deploying sophisticated Windows and macOS payloads over infrastructure tied to Cloudzy/RouterHosting (JUMPSEC). · Threat Activity · also via messaging app

July 22, 2026

• DPRK's "ClickFake Interview" campaign is impersonating recruiting platforms to drop the PylangGhost and GolangGhost RATs via spoofed platform and panel API endpoints. SOCRadar. · Threat Activity

July 18, 2026

• Iranian APT Nimbus Manticore (UNC1549) ran two fake LinkedIn recruiter accounts with AI-generated photos and LinkedIn work-email verification, impersonating HR at firms previously used in its phishing campaigns (Nextron). · Threat Activity

July 16, 2026

• Intel 471's "Operation Fake KickOff" abuses fake recruiters and SaaS to harvest Google Workspace credentials with real-time MFA bypass since April 2025; defenses include phishing-resistant MFA and domain monitoring. Intel 471 · Threat Activity

June 19, 2026

• Rokarolla, a new Android banking trojan, targets 217 banking/crypto apps with 137 remote commands — overlays, keylogging, clipboard hijacking and near-total device control — spread via fake TikTok and Chrome downloads (The Hacker News, Dark Reading). · Threat Activity & Intrusions

June 17, 2026

• Contagious Interview (Famous Chollima / North Korea) continues weaponizing developer recruitment and code-review themes to deliver malware through dev tools. The Hacker News. · Threat Activity