How to Recognize North Korean Phishing, Fake Job Malware, and QR Scams

North Korean-linked scams usually reveal themselves through the action they demand: run an unfamiliar coding project, install a trading application, scan a QR code, or lend your identity and home internet connection to a supposed worker. Treat those requests as stop-now warnings, even when the sender has fluent English, a convincing website, or a real company logo. The four major patterns are fake recruiter coding tests (WaterPlum/Contagious Interview), crypto trading-app lures (TraderTraitor and AppleJeus), QR-code credential theft by Kimsuky, and illegal facilitator jobs for North Korean remote IT workers. This guide shows the specific messages, files, interview behavior, and recovery steps documented by U.S. and allied authorities.

What are the main North Korean-linked scam patterns?

No single email proves state attribution. Government agencies make that judgment from infrastructure, malware, intelligence, and victim patterns. You can still act safely by recognizing the behavior.

Campaign type	Who appears to contact you	What you are asked to do	What the attacker wants	Safest response
WaterPlum / Contagious Interview	A fake employer, recruiter, or recruiting service	Download a repository, npm package, Visual Studio Code project, or “fix” a video call	Browser passwords, wallet seeds, identity documents, screenshots, keylogging, and an employer foothold	Never run recruiter code on a device containing keys or work access; verify the employer independently
TraderTraitor / AppleJeus	A fake recruiter, investor, or crypto professional	Install a trading or price-prediction app, or run an “update”	Private keys, exchange access, network credentials, and fraudulent blockchain transfers	Contact the company through a known channel and reject unsolicited trading software
Kimsuky quishing	A spoofed colleague, embassy employee, adviser, or conference organizer	Scan a QR code and sign in on your phone	Session tokens and cloud credentials that can bypass ordinary MFA alerts	Do not scan QR codes from unsolicited messages; verify on a separate channel
IT-worker facilitator scam	A fake freelance client or “foreign developer”	Interview for someone else, host a laptop, lend an account, or ship equipment	Identity fraud, covert access to a company, data theft, and revenue for the DPRK	Refuse, preserve the messages, and report the offer to the FBI and IC3

These paths overlap in their use of social engineering, stolen identities, and professional networking sites, but they target different people. A developer may receive a malicious coding assignment; a policy expert may receive a QR invitation; a financially stressed job seeker may be offered money to host a laptop.

How do I spot the fake recruiter coding-test malware?

The decisive warning is a request to execute code before you have independently verified the employer. The joint Japan National Police Agency–FBI advisory describes actors posing as legitimate artificial-intelligence, cryptocurrency, NFT, and recruiting companies, then sending a technical assignment or claiming that a video call will not work until you run a supplied file.

Red flags in the conversation

• The “employer” moves you from a normal professional platform to an unfamiliar messenger without a business reason.
• A pre-employment test requires an unknown Node.js or npm package, PyPI package, shell script, GitHub or Bitbucket repository, or a project folder you must open and trust.
• The recruiter says your camera, microphone, or video-call connection is blocked by your location and supplies a script to repair it.
• The job is unexpectedly high-paying, arrives without a normal interview process, or demands cryptocurrency payment or payment to another person.
• The contact refuses a live meeting on a second service, uses a resume with an implausibly broad skill list, or has a career history that jumps among countries without a coherent explanation.
• During a video interview, you notice glances toward another monitor, unexplained voices, or repeated freezes while the person avoids meeting in person.

Why a normal-looking repository can be dangerous

WaterPlum actors hide malware in developer collaboration sites and code repositories so that the request resembles ordinary engineering work. A Visual Studio Code folder can contain a configuration that runs automatically after a user opens and trusts the project. Blockchain-themed documentation and polished screenshots do not make a repository safe.

The advisory names several families. BeaverTail is JavaScript malware hidden in npm packages and distributed through repositories. InvisibleFerret is a Python-based backdoor. OtterCookie is a JavaScript remote-access trojan and infostealer, while OtterCandy combines OtterCookie with additional remote-access features. StoatWaffle is a modular Node.js family delivered as a malicious Visual Studio Code project; its components can load further code, harvest credentials, and provide remote access. Package names and command-and-control addresses change, so the request itself is a more durable indicator than a hash list.

What the malware tries to take

• Passwords and session data stored by web browsers.
• Clipboard contents, keystrokes, screenshots, and files.
• Cryptocurrency wallet private keys and seed phrases.
• Photographs of passports, driving licences, and other identity documents that can be reused in later fraud.
• Source-control, cloud, or employer-network credentials that turn a personal computer into an entry point.

From around December 2025 through July 2026, at least 30,000 devices in more than 100 countries were infected, including Japan and the United States — Japan NPA and FBI, 2026. Investigators said the campaign accessed more than 7,000 cryptocurrency wallets and transferred at least 1.7 billion Japanese yen (USD 10.71 million) to the DPRK — Japan NPA and FBI, 2026.

What should I do if a coding test seems legitimate?

1. Find the company using a search engine and open its official site yourself; do not use the recruiter’s link or phone number.
2. Call or video-chat through contact details you already had, and ask the company’s security or recruiting team to confirm the assignment.
3. Never use a work computer or a machine containing wallet seeds, password-manager vaults, cloud-console credentials, or source-control tokens.
4. If an assignment is unavoidable, use an isolated virtual machine on a non-company device with no access to your secrets. A device supplied by the tester should never be connected to your keys or work network.
5. Do not open a project folder and click “trust” merely because the editor displays a warning or the recruiter tells you it is required.

How do TraderTraitor and AppleJeus fake trading apps work?

These campaigns target cryptocurrency exchanges, DeFi teams, developers, system administrators, and large holders. Messages often mimic recruitment and promise a high-paying role, then direct the recipient to a modern-looking site hosting an Electron or other JavaScript desktop application.

The app and the fake update

The program presents itself as a portfolio, market-analysis, or price-prediction tool. Some observed samples include DAFOM, TokenAIS, CryptAIS, and AlticGO, with related branding such as Esilet and CreAI Deck. A bundled routine such as UpdateCheckSync() can pretend to check for updates, write a downloaded payload to a temporary folder, and execute it. macOS and Windows samples have delivered Manuscrypt, a custom remote-access trojan; some Apple digital signatures were later revoked.

Earlier AppleJeus campaigns used names including Celas Trade Pro, JMT Trading, Union Crypto, Kupay Wallet, CoinGoTrade, Dorusio, and Ants2Whale. A message might point to a fake company site, use a weakly verified certificate, and rely on a professional conversation that has lasted for weeks. Fluent English, detailed knowledge of cryptocurrency, and stolen profile photographs are part of the deception, not proof of legitimacy.

Crypto-focused warning checklist

• An unexpected “recruiter” asks you to install software on a company-owned computer or any device that can reach an internal network.
• A pre-employment test uses non-standard Node.js, PyPI, or GitHub code instead of a documented, auditable process.
• A prominent technology or cryptocurrency company offers unusually high compensation without negotiating role, location, or experience.
• An unsolicited person offers an investment, asks you to move the discussion to another platform, or sends an unexpected attachment.
• You are told to install custom software for a simple video call, server connection, or account check.
• The app requests wallet permissions, private keys, seed phrases, browser extensions, or “temporary” access to an exchange account.

North Korea’s parallel theft track can be enormous: approximately USD 1.5 billion in virtual assets stolen from Bybit on or about 21 February 2025 — FBI, 2025. The FBI attributes that activity to TraderTraitor and said the stolen assets began moving across thousands of addresses.

The FBI’s September 2024 warning describes a patient approach: actors scout professional-networking sites, build rapport, impersonate recruiters or known contacts, and research companies linked to cryptocurrency exchange-traded funds. The FBI also cautions that even experienced security professionals can be vulnerable to these elaborate schemes.

Why are QR codes in emails a separate threat?

Kimsuky’s quishing campaigns move the victim from a protected work computer to a personal phone, where ordinary email filtering cannot inspect the destination as effectively. A QR code can lead to a mobile page that fingerprints the phone’s operating system, browser, location, and screen size before displaying a fake Microsoft 365, Okta, Google, or VPN login.

What the 2025 examples looked like

• In May 2025, a message impersonating a foreign-policy adviser sent a think-tank leader a QR questionnaire about Korean Peninsula developments.
• Another May message impersonated an embassy employee and offered a QR link to a supposed secure drive about North Korean human rights.
• A spoofed think-tank colleague sent a QR code that redirected to Kimsuky infrastructure.
• In June 2025, a fake conference invitation used a QR registration button leading to a counterfeit Google sign-in page.

The FBI defines the technique this way: “Quishing (QR Code Phishing) is a phishing technique in which adversaries embed malicious URLs inside QR codes to force victims to pivot from their corporate endpoint to a mobile device, bypassing traditional email security controls.”

After a phone login, the operation may steal a session token rather than merely a password. The FBI warns: “Quishing operations frequently end with session token theft and replay [T1550.004], enabling attackers to bypass multi-factor authentication [T1550.004] and hijack cloud identities without triggering typical “MFA failed” alerts.”

Should I scan a QR code from a think tank, embassy, or colleague?

Do not scan an unsolicited code from email, a letter, a flyer, or packaging. Contact the sender through a phone number or chat account you already trust, ask whether the code was sent, and navigate to the organization’s known website manually. Phishing-resistant MFA using FIDO2 or WebAuthn security keys adds protection for email, cloud services, source control, and VPN access, but it does not make an unexpected QR login safe.

How do North Korean IT-worker facilitator scams target nontechnical people?

This path is usually fraud and sanctions evasion rather than inbox malware. A fake freelance client offers money to interview for another person, receive a laptop, host equipment at home, lend a professional account, ship packages, or complete fingerprint and drug tests.

Signs that an “easy freelance gig” is illegal

• The client says a Chinese or East Asian national needs a temporary U.S. presence, or claims to be an Eastern European displaced by the Russia–Ukraine war.
• You are asked to appear on camera, answer interview questions, or keep a company laptop online from your home.
• The client wants your social-media or professional-network login, identity documents, bank account, or address.
• Official-looking documents, a polished company story, and payment promises replace ordinary employment verification.
• You are told to ship equipment, receive packages, install remote-access software, or conceal who is actually doing the work.
• After a termination or dispute, the operator threatens managers, relatives, source-code disclosure, or physical retaliation.

The FBI states that “The general public needs to be aware that North Korean ITWs increasingly rely on the help of witting and unwitting Americans to acquire jobs in the United States, and they strategically target those under financial stress.”

North Korean government agencies are estimated to receive 85–90 percent of the revenue IT workers generate — FBI, 2026. Thousands of workers have attempted U.S. employment and the scheme generates hundreds of millions of dollars annually — FBI, 2026. Individual workers have reportedly earned up to USD 300,000 annually — FBI, Treasury, and State joint advisory, May 2022, restated by DOJ in 2026.

Participating can expose you to criminal investigation, sanctions violations, identity theft, and retaliation. The FBI’s instruction is unambiguous: do not let another person use your identity to apply for a job, do not interview for someone else, and do not receive or host a laptop for someone you do not personally know.

How large are these operations?

In an October 2026 Ohio indictment, prosecutors alleged more than 70 U.S. company employers and approximately USD 3 million in revenue. In a separate sentenced scheme, stolen identities of at least 80 U.S. people were used to obtain jobs at more than 100 companies, including Fortune 500 firms; prosecutors said the operation generated more than USD 5 million for the DPRK and caused at least USD 3 million in company damages. Operation Lonestar Roundup in September 2026 involved searches at more than 40 Texas residences and seizure of approximately 187 laptops and KVM devices.

Those cases concern specific defendants and allegations; defendants are presumed innocent unless convicted. The practical rule for a recipient is still simple: reject identity-lending and laptop-hosting offers before money, equipment, or personal data changes hands.

What should I do before clicking, scanning, or running anything?

1. Verify independently. If contact began on LinkedIn or a job board, confirm it with a live call on a different service or a telephone number obtained independently. Do not rely on the recruiter’s link, email signature, or caller ID.
2. Separate experiments from secrets. Keep wallet seeds, private keys, password-manager vaults, cloud consoles, and source-control tokens off internet-connected devices used for interviews. Never place them on a test machine.
3. Use phishing-resistant MFA. FIDO2/WebAuthn security keys protect email, cloud, source control, and VPN accounts better than passwords or one-time codes that can be phished.
4. Keep crypto keys offline. The FBI advises not storing wallet logins, seed phrases, or private keys on internet-connected devices. A hardware wallet can keep signing material separate from a browsing computer.
5. Apply enterprise controls. Cryptocurrency companies should allowlist executables, disable email attachments by default, and require multiple unconnected approvers before moving assets.
6. Refuse facilitator requests. Do not lend an identity, account, address, interview, laptop, or home network in exchange for payment.

What should I do if I already ran the file or scanned the QR code?

1. Disconnect immediately. Remove network access by unplugging Ethernet or disabling Wi-Fi and cellular data. Do not continue the conversation from the affected device.
2. Leave it powered on. The FBI advises preserving the powered-on state so investigators can capture malware artifacts. Do not casually wipe or re-image a device that may be evidence.
3. Use a clean device. Change passwords and revoke active sessions for email, source control, cloud services, exchanges, and password managers. Assume browser-stored passwords and wallet extensions may be exposed; move crypto assets through a safe process coordinated with the exchange or incident-response team.
4. Preserve identifiers. Save screenshots, email headers, usernames, phone numbers, wallet addresses, recruiter profiles, repository links, bank details, shipping addresses, and the names of people who received equipment.
5. Report it. File a detailed complaint at ic3.gov and contact your local FBI field office. Companies should revoke accounts and sessions, preserve logs, and involve counsel before re-imaging if a criminal referral is likely.
6. Escalate immediate danger. The FBI says, “Be aware ITWs have used threats of violence and other acts of intimidation to try to compel Americans to continue illicit activities. If you or someone you know receives a threat to life or is concerned about physical safety, call 911.”

Do not assume that an antivirus alert, a changed password, or a deleted message proves the incident is over. Session tokens, browser data, and secondary accounts may remain usable until they are revoked.

What can employers and gaming communities do to reduce exposure?

Studios, esports organizations, crypto teams, and online communities often combine public portfolios, private repositories, payment accounts, and chat platforms, making them attractive targets. Apply controls that do not depend on recognizing a particular malware family.

• Require recruiting staff to confirm technical assignments through a second internal channel before a candidate receives code.
• Provide a clean, managed environment for coding tests; prohibit unknown repositories on production or developer machines with signing keys.
• Block or quarantine unsolicited executable attachments and restrict package installation to approved registries and lockfiles.
• Require security-key MFA for privileged accounts and review active sessions after any suspicious QR login.
• Use endpoint and mobile-management tools that inspect QR-linked URLs and prevent unmanaged phones from authenticating to sensitive services.
• Train moderators and community managers that “move to another app,” “run this fix,” and “scan this registration code” are social-engineering requests, not routine support.
• For remote hiring, use identity in depth: live verification, multiple independent documents, work-history checks, and payment-account consistency. No single signal is reliable, and static name ban-lists can punish victims of identity theft.

How do the names Lazarus, TraderTraitor, WaterPlum, and Kimsuky relate?

The names are not interchangeable. Lazarus Group is a broad label for activity associated with North Korea’s Reconnaissance General Bureau. HIDDEN COBRA is a U.S. government catch-all for DPRK malicious cyber activity. TraderTraitor identifies the FBI’s crypto-application and Bybit cluster; APT38, BlueNoroff, BeagleBoyz, and Stardust Chollima are overlapping financial-theft labels.

WaterPlum and the industry name Contagious Interview describe fake-job malware and related IT-worker infiltration associated in the Japan NPA–FBI advisory with the Munitions Industry Department’s 313 General Bureau. Kimsuky is a separate espionage-focused cluster known for QR spearphishing against policy targets. Government and MITRE reporting warns that personnel, malware, and infrastructure can be shared, so assigning one email to a specific unit is often low-confidence.

A related October 2026 report described Operation FlashHole emails aimed at South Korean construction, software, and wire-communications companies. Those messages used fake GitHub Pages résumé sites and outdated INISAFE CrossWeb EX software. It is a geography-specific example, not a reason to merge every North Korean campaign into one family; the recognition rules above remain the safer guide.

Why does this matter beyond one compromised account?

The FBI says North Korean cybercrime and IT-worker schemes fund the government, including nuclear weapons and other military programs. John A. Eisenberg, Assistant Attorney General for National Security, said on 13 October 2026: “North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or our allies.”

Brett Leatherman, Assistant Director of the FBI Cyber Division, said: “North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs.” Ryan Raybould, U.S. Attorney for the Northern District of Texas, added: “This investigation is about far more than fraud. It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders.”

The FBI’s public warning summarizes the defensive mindset: “North Korean social engineering schemes are complex and elaborate, often compromising victims with sophisticated technical acumen.” A request to run one package, scan one code, or host one laptop can therefore be the opening move rather than the whole attack.

Frequently Asked Questions

Can antivirus software reliably identify North Korean phishing malware?

No. Malware families, package names, certificates, and command-and-control infrastructure change frequently, and a clean scan does not validate a recruiter or QR destination. Use endpoint protection as one layer, while treating the requested action and independent verification as the primary decision points.

Should I report a suspicious recruiter if I did not download anything?

Yes. Preserve the profile, email headers, phone numbers, payment instructions, repository addresses, and screenshots, then report the contact through your employer and to the Internet Crime Complaint Center. Early reports can connect the same identity or infrastructure to other victims before the account disappears.

Is it safe to scan a QR code from someone I know?

A familiar name or compromised mailbox is not proof that the message is genuine. Confirm the exact message through a separate channel and open the organization’s known website manually instead of scanning the code; never enter credentials into a page reached only through an unsolicited QR image.

What if I accepted money to interview for another person?

Stop all further activity, do not host equipment or share additional credentials, and preserve the contracts, payment records, messages, and shipping information. Contact the FBI or IC3 promptly; if anyone threatens you or your family, call 911 rather than negotiating.