A developer friend sent me a screenshot in July of a “coding challenge” a recruiter had asked him to complete: clone a GitHub repo, add a small feature to what looked like a blockchain gaming project, submit a pull request. He almost ran it. What stopped him was noticing the repo had exactly one contributor and a README that read like it was translated from another language. That instinct probably saved his machine, and possibly his employer’s network, from exactly the kind of attack security researchers have spent the past year documenting at genuinely alarming scale.
Quick Answer
- North Korea-aligned groups, most prominently Lazarus and a cluster tracked as “Famous Chollima,” are running large-scale campaigns that pose as recruiters on LinkedIn, Discord, Telegram, and freelance platforms specifically to get targets to run malicious code.
- The most common current technique is a fake “coding challenge” or technical assessment hosted on GitHub, trojanized with malware families like BeaverTail, InvisibleFerret, or OtterCookie, which steal credentials and cryptocurrency wallets once executed.
- A newer variant called ClickFix skips the file download step entirely, instead tricking the victim into pasting and running a command directly in a terminal or PowerShell window during a fake “troubleshooting” step, which lets the attack sidestep a lot of standard file-based malware defenses.
How the Fake Recruiter Playbook Actually Works
This isn’t a single scam, it’s a documented, disciplined multi-stage operation that researchers have been tracking under names like “Operation Dream Job” and “Contagious Interview” since at least 2022. Attackers build convincing recruiter profiles on LinkedIn, sometimes backed by fake front companies specifically in crypto and Web3 spaces to add credibility, and target primarily freelance and full-time software developers.
The interaction generally follows a familiar arc: initial outreach with a legitimate-sounding job opportunity, sometimes referencing well-known companies (one documented decoy used an actual Lockheed Martin job description), followed by a request to complete a technical assessment. That assessment is where the actual attack lives, packaged as a coding test involving an existing project, commonly something like adding a feature to a blockchain game or a crypto gambling platform, hosted on GitHub with all the necessary files already trojanized.
[COMMON TRAP] Don’t assume a legitimate-looking GitHub repository with commit history and a README proves a coding challenge is safe. Researchers have documented these repos being deliberately built to look like ongoing, credible projects. Check the actual contributor count and account age instead, a repo with a single contributor, a recently created account, or commit history that only spans the last few days is a far more reliable red flag than how polished the README looks.
The Malware Itself, and What It Actually Does
Once a victim executes the trojanized project, malware families including BeaverTail, InvisibleFerret, and OtterCookie run silently in the background. Their documented capabilities include stealing saved credentials, draining cryptocurrency wallets, and establishing backdoor access into whatever network the victim’s machine connects to, which is exactly why this attack targets employed developers specifically, not just individuals: a single compromised developer laptop can become an entry point into their employer’s entire internal network.
The most serious documented escalation of this technique surfaced in August 2026, when Check Point researchers found Lazarus pairing fake job offers with a genuine Windows zero-day vulnerability (CVE-2026-68820) in the Windows AFD.sys driver, targeting the defense and aerospace sector specifically. The malware chain used an in-memory downloader called MISTPEN, which profiled the compromised system before deploying the vulnerability to gain SYSTEM-level privileges and installing a kernel-mode rootkit named FudModule, built specifically to interfere with security monitoring tools. Microsoft patched that specific vulnerability on August 11, 2026, as part of that month’s regular Patch Tuesday update, but the case illustrates how far beyond simple credential theft this campaign has scaled.
| Component | What It Does |
|---|---|
| BeaverTail / InvisibleFerret / OtterCookie | Credential and crypto wallet theft, backdoor network access |
| MISTPEN | In-memory downloader, profiles the system before deploying further payloads |
| FudModule | Kernel-mode rootkit designed to blind security monitoring tools |
| ClickFix technique | Skips file downloads entirely, tricks victim into running a command directly |
[PRO TIP] Enterprise security teams should specifically restrict script execution permissions where feasible and establish a clear, low-friction internal reporting path for employees who encounter anything resembling this pattern, so a near-miss gets escalated rather than quietly ignored out of embarrassment. Given that this campaign specifically targets employed developers to reach corporate networks, a single well-trained employee catching the pattern early protects far more than just their personal device.
ClickFix: The Newer Variant That Skips the File Download
This is worth understanding as its own distinct technique, since it changes what defenses actually matter. In the ClickFix variant, documented by researchers as used by the group tracked as Famous Chollima, attackers pose as recruiters through the same channels, LinkedIn, Discord, Telegram, and email, guide the target through a fake skill assessment or interview process, and then fabricate a technical problem the victim supposedly needs to fix. The “fix” involves pasting a specific command into a terminal, Run dialog, or PowerShell window.
Because the victim manually executes the command themselves, rather than a file silently running malicious code on its own, this approach sidesteps a meaningful portion of automated file-scanning defenses that would otherwise flag a downloaded executable. The single most effective piece of guidance researchers consistently emphasize here: legitimate technical support, interview processes, or skill assessments never ask you to paste and run a command in a terminal or PowerShell window as part of “troubleshooting.”
(Compared using: published threat intelligence from ESET Research, Check Point, SOCRadar, and Microsoft’s March 2026 report on AI-assisted North Korean cyber operations)
Troubleshooting Common Situations
A “recruiter” is asking you to run a coding challenge that involves downloading and executing an existing project, not writing code from scratch. Treat this specifically as a red flag pattern, not a normal technical assessment. Legitimate coding challenges from real companies typically involve writing new code in a sandboxed environment (like a shared online IDE) rather than asking you to clone and execute an existing repository on your own machine.
You’re mid-interview and someone asks you to paste a command into your terminal to “fix” a technical issue with a shared screen or assessment tool. Stop immediately and do not run the command. This matches the documented ClickFix pattern precisely, and no legitimate technical process requires manually executing a command to resolve a setup issue during an interview.
You already ran a suspicious coding challenge or pasted a command you’re now unsure about. Disconnect the affected device from the network immediately, change passwords for any accounts accessed from that device (starting with anything involving cryptocurrency or financial access), and run a full malware scan. If the device has any connection to a work network, notify your employer’s security team immediately regardless of any embarrassment, since early reporting is exactly what limits damage to the broader network.
FAQ
Who is actually behind these fake job offer campaigns? Primarily North Korea-aligned state threat actors, including the well-documented Lazarus group and a cluster tracked as Famous Chollima, running long-term operations documented under names like Operation Dream Job and Contagious Interview since at least 2022.
Why do these attacks specifically target software developers? Developers routinely download and execute code as a normal part of their job, which makes a trojanized coding challenge or GitHub repository far less suspicious to them than it would be to most other professionals, and a compromised developer machine often provides a path into an employer’s broader corporate network.
What is the ClickFix technique specifically? A variant where attackers skip file downloads entirely and instead trick the victim into manually pasting and executing a command in a terminal or PowerShell window, framed as fixing a technical problem during a fake interview or assessment process.
Is this really connected to state-sponsored hacking, not just ordinary cybercriminals? Yes, multiple independent security research organizations, including ESET, Check Point, and Microsoft, have attributed these specific campaigns to North Korea-aligned threat actors, and in some cases the operation is directly linked to broader sanctioned activity, including a parallel scheme involving fake North Korean IT workers infiltrating real companies.
How do I verify if a recruiter or job offer is legitimate? Verify the company independently through its official website rather than trusting contact information provided by the recruiter, be wary of coding challenges that require downloading and running an existing project rather than writing new code in a controlled environment, and treat any request to paste a command into a terminal as an immediate red flag regardless of the justification given.
What should a company do if an employee reports encountering this pattern? Treat it as a genuine security incident requiring investigation, not a minor annoyance. Check whether any code was executed, isolate potentially affected devices from the network, and use it as a concrete opportunity to reinforce the specific warning signs across the broader team, since this campaign has been documented targeting the same techniques repeatedly across many organizations.
Conclusion
The fake job offer as an attack vector has evolved from a relatively simple phishing email into a disciplined, well-resourced operation capable of pairing social engineering with genuine zero-day exploits, as the August 2026 Lazarus campaign against defense contractors demonstrates. The core defense hasn’t changed as much as the sophistication of the attacks has: be skeptical of coding challenges requiring you to execute someone else’s existing project, and treat any request to paste and run a terminal command during an interview or technical support interaction as a hard stop, not a troubleshooting step.
If phishing more broadly is a concern beyond this specific job-offer variant, it’s worth reading what to do in the first hour after you click a phishing link, and since social engineering is the real mechanism underneath this entire campaign, what social engineering actually is and why technical security can’t fully stop it covers the broader pattern this attack fits into.
