A campaign posing as legitimate job recruitment has compromised at least 30,000 devices across more than 100 countries and drained $10.71 million from over 7,000 cryptocurrency wallets, according to a joint cybersecurity advisory covered by The Hacker News on 21 September.

The operation, dubbed "Contagious Interview," exploits the trust inherent in remote hiring workflows to trick web designers, software engineers, and cryptocurrency specialists into running malicious code on their own machines. Security researchers have attributed the campaign to North Korean threat actors and linked it to prior espionage and financially motivated operations.

How the Attack Works

The scheme begins with unsolicited outreach on professional networks or via email, offering a remote technical position. Candidates are asked to clone a GitHub repository or download a Node.js project as part of a "practical assessment." Once executed, the package deploys obfuscated scripts that install information-stealers designed to harvest browser data, session cookies, wallet files, and SSH keys. The exfiltrated data gave attackers access to thousands of cryptocurrency wallets, producing the bulk of the reported financial losses.

The campaign's effectiveness hinges on a cultural norm in software hiring: candidates are routinely expected to execute unfamiliar code as proof of competence, and pushing back on that expectation can feel professionally risky. Threat actors have turned that dynamic into an attack surface. By compromising a single developer's machine, they gain not only immediate financial access but also a potential foothold into supply chains and development environments for sustained operations.

What Developers Should Do

The advisory urges developers to treat recruitment-related code execution with the same caution they would apply to any untrusted software. Practical steps include:

  • Verify the recruiter independently. Check the company's official website and LinkedIn presence before engaging. Be skeptical of offers that arrive unsolicited or seem unusually lucrative.
  • Never run recruitment code on a production machine. Use a dedicated, sandboxed virtual machine or disposable cloud instance isolated from personal projects and credentials.
  • Inspect before executing. Review package.json for unfamiliar post-install scripts or suspicious dependencies. Run npm audit to flag known vulnerabilities, though custom malware will not appear in vulnerability databases.
  • Protect cryptographic assets. Store wallet files and seed phrases in offline hardware wallets. Never enter credentials into any application or site provided by a recruiter.
  • Report suspicious outreach. Flag dubious offers to the platform where they originated and warn colleagues in your professional network.

The Contagious Interview campaign underscores that attackers no longer need to breach an organization directly. By targeting the individuals who build and maintain software — through the very hiring processes designed to evaluate them — they turn a routine professional activity into a credential-harvesting operation. For developers, the takeaway is straightforward: vet recruitment outreach with the same rigor applied to any other external dependency.

根據《The Hacker News》9月21日報導的聯合網絡安全警告，一場偽裝成正規招聘的惡意活動已在全球超過100個國家入侵至少30,000台設備，並從逾7,000個加密貨幣錢包中提取了1,071萬美元。

這項被命名為「傳染式面試」的行動利用遠程招聘流程中固有的信任機制，誘騙網頁設計師、軟件工程師及加密貨幣專家在自己的設備上運行惡意代碼。安全研究人員已將此活動歸咎於朝鮮黑客組織，並指出其與先前的間諜及金融動機攻擊有關聯。

攻擊運作方式

攻擊始於透過專業網絡或電郵發送未經請求的聯繫，提供遠程技術職位。應聘者會被要求複製GitHub倉庫或下載Node.js項目作為「實務評估」環節。一旦執行，該軟件包便會部署混淆腳本，安裝信息竊取程序以獲取瀏覽器數據、會話Cookie、錢包文件及SSH密鑰。被竊取的數據使攻擊者得以訪問數千個加密貨幣錢包，構成報導中主要的財務損失。

該活動的成功源於軟件招聘中的文化慣例：應聘者通常被期望執行陌生代碼以證明能力，而對此要求提出質疑可能帶來職業風險。威脅行為者將這種態勢轉化為攻擊面。通過入侵單一開發者的設備，他們不僅能立即獲得財務訪問權限，更可能獲取進入供應鏈及開發環境的立足點，進行持續性操作。

開發者應採取的措施

該警告敦促開發者以對待任何不受信任軟件的謹慎態度，處理招聘相關的代碼執行。具體措施包括：

  • 獨立核實招聘方。 聯繫前應查閱公司官網及LinkedIn官方頁面。對未經請求或看似異常豐厚的招聘邀請保持警惕。
  • 絕不在生產機器上運行招聘代碼。 使用專用的沙盒虛擬機或一次性雲實例，與個人項目及憑證隔離。
  • 執行前先檢查。 審查package.json中是否存在陌生的安裝後腳本或可疑依賴項。運行npm audit以標記已知漏洞（儘管定制惡意軟件不會出現在漏洞數據庫中）。
  • 保護加密資產。 將錢包文件及助記詞存儲於離線硬件錢包。切勿在招聘方提供的任何應用或網站上輸入憑證。
  • 舉報可疑聯繫。 向該信息來源平台標記可疑招聘邀請，並提醒專業網絡中的同事。

「傳染式面試」活動凸顯了攻擊者已無需直接入侵組織機構。通過針對構建及維護軟件的個體——利用本用於評估他們的招聘流程——將日常職業活動轉化為憑證收割行動。對開發者而言，啟示明確：應以審視任何外部依賴項的嚴謹態度，核實招聘邀請。

新聞來源 / Original News Source