Job Seekers Archives

As part of an ongoing financial campaign dubbed Contagious Interview, North Korean threat actors have used a spoof Windows video conferencing application that impersonates FreeConference.com to backdoor developer systems. The latest round of attacks, discovered in mid-August 2024 by the Singaporean business Group-IB, provides additional proof that the activity is also using native installers for Apple macOS and Windows to spread malware. A malicious campaign known as Contagious Interview, also monitored as DEV#POPPER, was launched by a North Korean threat actor known by CrowdStrike as Famous Chollima. A fake job interview is used to trick job seekers into downloading and running a Node.js project that contains the BeaverTail downloader malware read more about North Korean Hackers...

Researchers studying cybersecurity have made public the specifics of a continuous phishing effort that uses baits related to jobs and recruitment to spread the Windows backdoor WARMCOOKIE. According to a recent investigation by researcher Daniel Stepanic of Elastic Security Labs, "WARMCOOKIE appears to be an initial backdoor tool used to scout out victim networks and deploy additional payloads." "Each sample is compiled with a hard-coded [command-and-control] IP address and RC4 key." The backdoor may take screenshots, drop further malicious programs, and fingerprint compromised PCs. The action is being monitored by the company using the code REF6127. Since late April, assault chains have been noticed that utilize emails posing as correspondence from employment agencies such as Ha...

Tag: Job Seekers

North Korean Hackers Targets Job Seekers with Fake FreeConference App

New Phishing Campaign Deploys WARMCOOKIE Backdoor Targeting Job Seekers