DPRK-Linked Malware Targeting Job Seekers via Wellfound

A DPRK-linked campaign used a fake job interview on Wellfound to deliver a sophisticated Rust-compiled infostealer that exfiltrates browser passwords and crypto wallet data via a malicious script and fake password dialog; the malware contacts a C2 at cloudproxy.link, employs a custom cipher for config values (571 decrypted strings), had low VirusTotal detection, and the incident was reported to the FBI.