- North Korean hackers use LinkedIn to scam job seekers
- The false job offer often promises well paid remote work
- But the victims are eventually infected with malware
A prolonged campaign of the notorious North Korean hacking group Lazarus has seen jobs hopeful scammed in many different ways, including downloading malware.
Now a new facet of the campaign ‘Contagious Interview’ has emerged, and this time hackers use LinkedIn for scams, research from Bitdefender warns.
LinkedIn can be a great tool for professionals to network, and many companies use the app to recruit new employees, and now it turns out, including the Lazarus group.
Malicious deals
The false recruitment fraud eventually results in the victim being infected with malware, and the hackers tend to target job seekers in high -profile industries, such as defense, aerospace or technique – who want to exfilter classified or sensitive information or even business information.
The fake job researchers observed in these scams were often remote work, flexible and well -paid, sometimes involved cryptocurrencies as payment. These are designed to be enticing offers, so be careful about everything that looks a little too good to be true.
Scammers will send a victim via LinkedIn, and then request a resume or Personal Github Repository Link (which could be used to harvest personal information). From there, ‘Recruit’ shares a ‘feedback’ document that infects the victim with malware.
There are some warning signs to look for, such as vague job descriptions, poor communication and users without popping documentations. Be sure to grow all job offers, applications and interview offers thoroughly – and do not click on any links from unknown sources.
In February 2025, Apple delivered a new patch on Xprotect, its malware removal tool to block variants of macO’s ‘ferret family’ – which had been found disguised as chrome or zoom installers targeting applicants.
