North Korean Job‑Seeker Scam Targets Crypto and Data

International security agencies have confirmed that a group known as WaterPlum, linked to North Korean hackers, is posing as prospective employers to infect devices and steal cryptocurrency and personal data. The United States, Japan, Germany and Australia reported that more than 30,000 computers worldwide have been compromised by this scheme.

The operation targets job seekers who respond to fake recruitment postings. Victims receive emails that appear to come from legitimate companies, often with a professional tone and a request to download a document or install a remote‑access tool. The software installed is a type of malware that can log keystrokes, capture screenshots and hijack cryptocurrency wallets. Once the malware is active, it silently exfiltrates login credentials and private keys, allowing the attackers to move funds and harvest personal information.

Anyone who searches for employment online, especially on freelance platforms or through unsolicited job offers, could be at risk. The threat is not limited to any single country; the compromised devices span multiple continents, reflecting the global reach of the campaign. Because the initial contact mimics a legitimate hiring process, many victims do not suspect foul play until financial loss or data misuse occurs.

To protect yourself, verify the source of any job‑related email before opening attachments or clicking links. Use a separate email address for job applications and enable two‑factor authentication on all accounts, especially those linked to cryptocurrency. Run regular scans with reputable anti‑malware tools; free options are listed on ComputerScams.com. Keep your operating system and software up to date to close known vulnerabilities that malware often exploits.

If you suspect a compromised device, disconnect it from the internet immediately, change passwords from a clean device, and report the incident to local law enforcement or a national cyber‑crime centre. Monitoring your cryptocurrency wallets for unauthorized transactions can also help limit losses.

A practical step you can take right now is to install a trusted password manager and enable its built‑in security alerts, which will warn you of any attempted logins to your accounts.

Source: Read the original report