A sophisticated recruitment scheme linked to North Korea has emerged, targeting American artificial intelligence experts, software engineers and cryptocurrency professionals through an elaborate fake job search platform.
See also: Australia: Sanctions on hackers supporting North Korea's weapons program
Validin security researchers have uncovered a new form of the business they are calling “Contagious Interview,” which is designed to lure candidates through a recruitment process that appears completely legitimate. The campaign leverages a fully functional job development platform based on React and Next.js, hosted on lenvny[.]com, which mimics leading technology and recruitment software companies, with an impressive degree of authenticity and professionalism.
The fake platform is presented as an “All-in-one AI interviewing tool” for hiring teams. It features a meticulously curated advertising environment, a modern gradient design, and synthetic branding that appears to be tailored to what the creators believe the AI and tech industry aesthetic will be in 2025.
This level of sophistication is a significant upgrade over previous recruitment traps attributed to North Korea, which were typically limited to simple login forms or basic phishing pages.
See also: US: Sanctions on 10 North Korean entities for money laundering
The platform includes dozens of routes, dynamically generated ads, and a full job application flow that reflects modern recruitment systems, making it extremely persuasive to unsuspecting candidates.
Validin security analysts spotted the malware after the second paragraph, noting that this particular business follows a consistent infection pattern: a LinkedIn message that leads to an interview process, which then asks candidates to record video responses, and finally prompts them to “fix the camera” via a helper tool. This seemingly innocent troubleshooting step essentially installs malware directly onto the target’s system.
Candidates should check that company career pages are hosted on official domains and avoid sending personal documents to unverified platforms.
See also: GhostCall & GhostHire: BlueNoroff's new campaigns
When someone is asked to run code during an interview, it is important to carefully review scripts and run unknown code only within virtual machines or sandbox environments, and not directly on their main workstation.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
