Security guide

Fake Job Interview Malware: North Korea's Recruiter Trap

A fake job interview attack is a hiring process built to get you to run someone else's code. North Korea-linked actors pose as recruiters, interview you on a legitimate job platform and a chat app, then send an “assignment” that runs malicious code when you set it up. Binance said exactly this happened to one of its engineers in September 2026.

The defence is a short list: verify the person through channels they do not control, never run an interviewer's code on a machine that matters, never install a “fix” to join a call, and tell security the moment you have. Employers also need to limit what one compromised laptop can reach.

Binance's account is its own and has not been independently verified, so this guide says “Binance said”. Defensive and educational only: no payloads, no commands.

Updated 3 November 2026 (last reviewed)

TL;DR

The short version

5 points

Binance said an engineer was contacted through a legitimate job platform in September 2026, interviewed in two rounds (a video call with a purported HR representative, then a chat-app interview with a purported CEO), and told to download an "assignment" to his work computer that executed malicious code during setup.
Vendors have documented the same pattern since 2023 under several names: Contagious Interview (Unit 42, MITRE), UNC5342 (Google), Famous Chollima and Void Dokkaebi, DEV#POPPER, Slow Pisces and Sapphire Sleet. They are not all the same actor.
Candidates: verify independently, read before you run, use a disposable environment, never install a "fix" for a call, and report fast.
Employers: no outside code on company devices, controlled developer-tool installs, no deployment tokens on workstations, least-privilege internal AI tools, whole-team scoping and blameless reporting.
If you ran it: disconnect, do not wipe, tell security, rotate secrets from a clean device in order of power.

How the lure works, stage by stage

The sources describe the same shape of attack. This is the stage-level pattern with the evidence for each stage; it deliberately omits any code, commands or infrastructure.

Stage	What happens	Evidence
1. Approach	A fake recruiter or “project director” contacts a developer on a job platform or social site, with a credible profile and a well-paid remote role.	Binance said the engineer was contacted through a legitimate job platform by someone whose profile referenced Binance experience. Google GTIG describes fabricated recruiting companies with their own websites and profiles.
2. Trust	One or two interview rounds. A video call with a friendly “HR” who shares a personal social profile; then a chat-app interview with a “CEO”.	Binance said the HR representative shared a social account with personal photos and videos, and the second round was in a popular chat app with someone claiming to be the CEO of a fictitious company. GTIG says conversations move to Telegram or Discord.
3. The ask	Download and run an “assignment”, install a “fix” to fix a call error, or run a setup step.	Binance said the engineer was told to download the assignment to his work computer. Unit 42 describes a benign PDF job description, a question sheet and a GitHub “real project”. Securonix and Trend Micro describe a project that the candidate is told to run. Microsoft describes a fake Zoom SDK update.
4. Execution	The code runs during setup, hides itself and calls out to attacker-controlled servers.	Binance said the code was obfuscated, replaced a legitimate development tool component (pyenv) with a malicious version, contacted an attacker-controlled server, was not detected by endpoint protection (a 0-day) and concealed its traces. Trend Micro describes an editor task that runs when a folder is opened after a trust prompt is accepted.
5. Collection and pivot	The foothold steals credentials and wallet or browser data, and is used to reach colleagues with more access.	Unit 42 describes BeaverTail stealing browser passwords and targeting 13 cryptocurrency wallet extensions, then an InvisibleFerret backdoor. Binance said the attacker used the engineer's computer and an internal AI tool to gain control over two colleagues, found a container deployment token on one computer and used it on 29 October.

What Binance said about its engineer

Binance's own account of the 29 October 2026 incident, which it says is an initial report subject to independent review, describes a multi-stage campaign rather than a simple phishing incident. The parts relevant to fake recruiters:

June 2026. A wallet DevOps engineer (A) downloaded a tampered Homebrew installation while installing a popular AI coding tool found through a search engine. Security detected the anomaly, replaced the device and rotated credentials, but A's role and wallet-team colleagues were exposed to the attacker.
September 2026. A software engineer (B) was contacted through a legitimate job platform, had a video interview with a purported HR representative, then a chat-app interview with a purported CEO of a fictitious company, and was told near the end to download an “assignment” to his work computer.
20 October 2026. The attacker used B's computer and an internal AI tool to gain control over A and a wallet software engineer (C), and found a container deployment permission token on A's computer.
29 October 2026. Between 17:15 and 19:56 the attacker logged on to C's computer, used credentials stolen from A, deployed a container and triggered a malicious script to launch the attack.
Scale of the threat. Binance said its security team detected and prevented 57 suspected North Korea-linked cyber threat cases during 2026, and that the FBI indicates North Korea is responsible for the incident.

Read the incident itself in our report, Binance hack and the Aave loan / USDT freeze. Binance did not say which tracked cluster ran the recruiter step; the next section explains why that matters.

Names: which vendor name means what

Vendors name the same activity differently, and some names refer to different things. Use a name only for the actor it refers to. Each row below is from the source named; accessed 3 November 2026. Our APT Rosetta Stone maps names across vendors, and our profiles cover TraderTraitor and Lazarus Group.

Name	Used by	What the source says	Do not confuse with
Contagious Interview	Palo Alto Unit 42 (campaign); MITRE ATT&CK (group G1052)	Fake recruiters and fake technical interviews that get developers to run malicious code. MITRE lists the aliases DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo and TAG-121.	MITRE does not state an overlap with Lazarus Group or Famous Chollima.
UNC5342	Google Threat Intelligence Group	The cluster GTIG says has used EtherHiding since February 2025 in the campaign Palo Alto calls Contagious Interview.	Not UNC4899, which is Google's designation for a different cluster (see the Slow Pisces row).
Famous Chollima	CrowdStrike	Profile lists Contagious Interview, UNC5342, Void Dokkaebi, Wagemole and Jasper Sleet among community identifiers. CrowdStrike's October 2026 blog uses the name for the IT worker laptop-farm scheme.	Covers two lines: fake recruiters and IT workers. Check which one a report means.
Void Dokkaebi	Trend Micro	Trend says it is "also tracked as Famous Chollima"; fake interviews that get a developer to clone and run a repository (April 2026).	Trend does not equate it with the Contagious Interview label in that report.
DEV#POPPER	Securonix	April 2024 campaign: a fake interviewer asks a candidate to download and run a project. Securonix says "likely associated with North Korean threat actors". MITRE lists it as an alias of Contagious Interview.	A campaign name, not a country-level attribution.
Slow Pisces (TraderTraitor, Jade Sleet, PUKCHONG)	Palo Alto Unit 42; FBI and CISA (TraderTraitor); Microsoft (Jade Sleet); Google (UNC4899)	Unit 42 documents recruiter outreach on LinkedIn, a PDF job description, then a "real project" coding challenge on GitHub. The FBI uses TraderTraitor for the Bybit theft. The Google UNC4899 mapping is as summarised in our TraderTraitor profile.	Unit 42 says it shares initial vectors with Contagious Interview but has no operational overlap.
Sapphire Sleet	Microsoft	April 2026: fake recruiter profiles, a technical interview, then a fake Zoom SDK update on macOS that steals credentials and crypto data.	Microsoft does not say which other vendors' names match it, so we do not map it.
Operation Dream Job	MITRE ATT&CK (campaign C0022)	Fake job offers and recruiter personas on LinkedIn and email, September 2019 to August 2020, attributed by MITRE to Lazarus Group.	An older campaign; do not use it as the name for 2024 to 2026 activity.
Lazarus Group	MITRE ATT&CK (G0032)	Umbrella term used in public reporting for several North Korean operators. MITRE lists aliases including Labyrinth Chollima, HIDDEN COBRA and Diamond Sleet.	Not a synonym for every North Korean campaign below.
North Korean IT workers	FBI IC3 (13 October 2026)	A different scheme: workers using false or stolen identities to get hired by employers, with facilitators in the US.	The opposite direction to a fake recruiter.

Two cautions. First, the Binance recruiter step is not assigned to any of these names in Binance's account. Second, a vendor's “likely” or “may be” is not a government attribution; the FBI's TraderTraitor attribution concerns the Bybit theft (FBI, February 2025).

Red flags for candidates

A recruiter you cannot verify outside the platform, at a company with no trace in registers, news or your network.
A very polished personal profile offered as proof: photos, videos, a long history. Binance said that was how trust was built.
The conversation moves quickly to a chat app, or the “CEO” interviews you in text only.
A take-home that needs you to download a repository and run a setup step, especially on a deadline.
A video-call error that tells you to install a “fix” or an “SDK update”. GTIG and Microsoft describe both.
A repository with install-time steps that contact outside hosts, editor settings that run tasks on opening, or odd hidden text. Trend Micro, Securonix and GitHub describe these.
Pressure: “other candidates are waiting”, “do it today”, “send a screenshot of the output”.

Run through the fake recruiter checklist, then rehearse in the interview lab.

Red flags for employers and HR

Fake recruiter profiles that claim your company or your alumni history (Binance said the fake project director's profile referenced Binance experience).
Staff with deployment, signing or production access who say they have been approached by recruiters. Brief them that working engineers are targeted, and tell them whom to inform.
A developer laptop that shows an anomaly after installing a developer or AI tool from a search result.
Outside code, interview or “opportunity” related, found on a company device.
Do not confuse this with applicants who are really North Korean IT workers. That is the opposite problem, covered by the FBI's “identity in depth” advice (FBI, 13 October 2026).

What employers should change

Isolate the unknown. No outside code on company devices, and a sanctioned disposable VM or cloud sandbox for the unknown. Binance said the engineer was told to download the assignment to a work computer; Trend Micro recommends disposable, isolated environments for interview assignments.
Do not host interviews on work devices. Candidates should use a personal or dedicated device with nothing of the employer's on it. Unit 42 recommends separating corporate and personal devices.
Control developer-tool installs. An approved internal mirror or allow-list for developer tools, package managers and AI coding tools. Binance said the June foothold came from a tampered installer found through a search engine.
Layer detection on developer machines. Binance said its malware was a 0-day not detected by endpoint protection and replaced a legitimate tool component. Add integrity checks for toolchains, enforce editor workspace trust, and monitor for unexpected network calls from developer tools.
Treat internal AI tools as a pivot path. Least privilege, per-user scoping, logging, access reviews and anomaly detection. Binance said the attacker used one to gain control over two colleagues.
Keep tokens off workstations. Short-lived credentials issued at deploy time; scan devices for stored secrets; alert on a deployment from an unexpected machine. Binance said a deployment token found on one engineer's computer was used in the attack.
Scope the whole team. When one developer device is flagged, review the team's exposure, not only the device. Binance said A's colleagues stayed exposed after the June device was replaced.
Make reporting blameless. Speed of reporting is the variable you control once a lure has worked.

Binance also described a signing service and Ethereum EIP-7702 delegations. Those controls have their own tools: the signing service controls checklist and the EIP-7702 delegation risk explainer. For the dependency and secrets side, see the Poisoned Dependency Lab and the Secret Rotation Order Planner.

If you ran it: stage-level response

Stop. Do not run anything else, do not enter more passwords on that machine.
Isolate. Disconnect the device from the network. Do not wipe it yet: your security team needs the evidence.
Tell security now. From another device. GitHub advises contacting your employer's cybersecurity department if you were targeted.
Rotate from a clean device, in order of power: deployment and cloud credentials, publish and signing keys, SSH keys, then password-manager and browser sessions, then personal wallets. GitHub advises resetting or wiping the device, changing passwords and rotating credentials and tokens.
Scope colleagues. What could this machine and your AI tools reach? Look back weeks, not days; Binance's timeline ran from a September interview to a late-October attack.
Report. The profile to the job platform; in the US, to ic3.gov or your local FBI field office. Elsewhere, to your national cybercrime service.

Use the Secret Rotation Order Planner to turn the list of exposed secrets into an ordered runbook.

What this guide does not claim

Binance's account has not been independently verified, and it said some technical details are confidential.
We do not say which tracked cluster ran the recruiter step at Binance; Binance did not say.
Vendor names are mapped only where a source maps them. Where a source is silent (for example Microsoft on Sapphire Sleet), we do not infer a match.
The Google UNC4899 mapping is reported in our TraderTraitor profile from a press summary of Google Cloud reporting and was not opened directly for this guide.

Last reviewed 3 November 2026. Vendor and government sources were read on 3 November 2026; Binance's account is quoted from its published blog post.

Frequently asked questions

What is a fake job interview attack?

An attacker poses as a recruiter or hiring manager, runs an interview process to build trust, and asks the candidate to download and run an "assignment" or install a tool. The assignment or tool runs malicious code on the candidate's computer. Binance said this is how a software engineer was first compromised before its 29 October 2026 incident.

Is Contagious Interview the same as Lazarus Group?

Not as far as the sources say. MITRE ATT&CK lists Contagious Interview (G1052) as its own group, "North Korea-aligned" and active since 2023, and does not state an overlap with Lazarus Group. MITRE calls Lazarus Group (G0032) a North Korean state-sponsored group that public reporting often uses as an umbrella term. Operation Dream Job, a 2019 to 2020 fake-job campaign, is the one MITRE attributes to Lazarus.

What is Famous Chollima?

CrowdStrike's name for a North Korea-nexus adversary. Its profile lists Contagious Interview, UNC5342 and Void Dokkaebi among community identifiers, and CrowdStrike's October 2026 blog uses the name for the IT worker scheme in which North Korean operatives get hired using false identities. It covers both lines of activity, so check which one a report is describing.

Are fake recruiters the same as North Korean IT workers?

No. In the fake recruiter scheme the attacker pretends to be the employer and targets the candidate. In the IT worker scheme the North Korean worker pretends to be the candidate and gets hired by the employer. The FBI's 13 October 2026 alert (I-101326-PSA) covers the second scheme.

Did Binance say who was behind the recruiter lure?

Binance said the FBI indicates North Korea is responsible for the incident. In the account we reviewed, Binance did not say which tracked cluster ran the recruiter step. Blockchain analytics firms TRM Labs and Chainalysis linked the theft to TraderTraitor, as reported at the time. Binance's account has not been independently verified.

How do I tell a fake recruiter from a real one?

Verify the company and the person through channels they do not control, and judge the request, not the profile. A real employer does not need you to run unknown code on a work computer, install a "fix" to join a call, or finish a take-home test on a deadline set by a stranger. Check the company on its own careers page, in business registers and through mutual contacts.

Is it safe to do a take-home coding test?

It can be, if the code never runs on a machine that matters. Read the repository as text first. If you run it, use a disposable virtual machine with no saved logins, keys or work access, and no network path to your employer. Trend Micro recommends running interview assignments only in disposable, isolated environments.

What should I do if I already ran the assignment?

Disconnect the device from the network, do not wipe it yet, and tell your employer's security team at once. From a different, clean device, change passwords and rotate keys and tokens, starting with the ones that grant the most access. Report the profile to the platform and, in the US, to ic3.gov.

What should employers change?

Ban outside code on company devices and give staff a sandbox for the unknown, control how developer tools are installed, keep deployment tokens off workstations, give internal AI tools least privilege, scope the whole team when a developer device is flagged, and make reporting blameless. These map to what Binance said happened.