North Korean Hackers Target Job Seekers With Social Engineering Tricks

ESET researchers attribute a targeted campaign to a North Korean actor called “DeceptiveDevelopment” that lures job seekers via fake recruiter profiles and coding tasks hosted on trojanized Git repositories; victims executing the provided code trigger BeaverTail first-stage malware. The actor also uses a ClickFix paste-to-terminal social-engineering trick and collects stolen data to support North Korea’s fraudulent IT worker operations.