North Korea’s job interview scam runs both ways

1. Executive summary

The Rust Project's crates.io team and security response working group have warned that attackers are targeting Rust Project members and maintainers of widely used crates with fake job, contract, and collaboration offers delivered over video calls, aiming to compromise their devices and accounts and ultimately publish malware into the package ecosystem. The techniques match those of the North Korea-linked Contagious Interview campaign, also tracked as WaterPlum, which per a 2026-09-18 advisory from authorities in Australia, Germany, Japan, and the US infected over 30,000 devices across 100+ countries and stole over $10 million (at least $10.71 million attributed) from more than 7,000 cryptocurrency wallets between December 2025 and July 2026. The same style of attack compromised the arrayref crate in August 2026 after a maintainer's credentials were compromised, briefly publishing malicious versions of a crate with 245 million lifetime downloads. Attribution to North Korea is unconfirmed for the Rust-specific wave: the Rust Project has not attributed it, and the match is technique-based. No CVEs are involved; this is a social-engineering and supply-chain exposure issue, not a patchable vulnerability.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The exposure is to individual maintainers and developers through social engineering rather than to a client's own ICT systems, and no incident at a financial entity is described in the source material. Clients whose in-house or contracted developers maintain open-source packages should treat this as a supply-chain risk-management input under existing third-party risk processes, but the source facts do not trigger a specific article in the provided reference.

3. Technical analysis & attack chain

The confirmed attack pattern against Rust maintainers, as described by the Rust Project's warning:

1. The attacker contacts a target via LinkedIn, social media, or online job platforms, using newly created but legitimate-seeming company profiles with plausible LinkedIn presences, often posing as recruiters from AI, blockchain, or NFT firms. In the June 2026 wave, approaches purported to come from a Singaporean venture capital firm that turned out to be defunct.
2. The target is convinced to join an online interview, usually with a coding component, or a general call about a collaboration.
3. During the call, the attacker uses tricks such as claimed technical difficulties or interview requirements to persuade the victim to run malicious code, install malware (for example a purportedly missing audio codec), execute an attacker-supplied command (for example a command placed on the clipboard), or enter account credentials into an attacker-controlled page.
4. Successful compromise yields persistent access to the victim's device and accounts. In the June 2026 case, crates.io maintainer Matt Mastracci's machine nearly became infected with a remote access trojan (RAT).
5. The end goal against crate maintainers is account or credential compromise sufficient to publish malicious crate versions. In August 2026, malicious versions of the arrayref crate were published that added a dependency fetching a malicious payload from a remote server. The evidence pointed to a compromised maintainer's credentials rather than deliberate action by the project's developers. The malicious releases were available for less than two hours; arrayref had recorded 245 million downloads over its lifetime.

The broader Contagious Interview / WaterPlum campaign, per the multi-agency advisory, works the same way at scale: targets are web designers, engineers, and cryptocurrency and Web3 specialists; files presented as coding assignments or recruitment tests are downloaded and opened, backdooring the machine. Operators then deploy RATs and information stealers, giving persistent access to credentials and sensitive data after the interview ends. Stolen data includes intellectual property, credentials, clipboard contents, keystrokes, cryptocurrency wallet data, and identity documents. Stolen IDs feed the parallel North Korean IT worker scheme, in which workers are hired into remote roles using impersonated identities, apply through the real LinkedIn accounts of the impersonated people, and use proxies on camera and laptop farms to maintain the location illusion. The agencies found that Contagious Interview operators and the North Korean IT worker operation share infrastructure and personnel. In some cases compromised jobseeker machines later provide a route into corporate systems once the victim secures legitimate employment.

Attribution caveat: the Rust Project's warning does not attribute the current wave, and it is difficult to tell whether the June, August, and September 2026 activity is one campaign. The technique match to Contagious Interview / WaterPlum is the basis for the North Korea association in reporting, and the multi-agency advisory attributes the broader campaign to North Korean operators. Lazarus Group (MITRE G0032) is the named actor in the verified reference data, but no source in this item ties the Rust activity to Lazarus Group specifically; treat the North Korea attribution for the Rust wave as unconfirmed and single-sourced to technique comparison.

4. Mitigation & containment

P1 (within 24h):

• Identify any employees or contractors who maintain open-source packages (crates.io, npm, PyPI, or equivalent) or hold publish rights on shared accounts, and warn them directly about recruiter-themed social engineering. This population is the target set.
• Instruct that population to treat any request during a call to install software, run a command, or paste from the clipboard as hostile, regardless of how routine it sounds, including "install this codec" and "run this to fix your audio".
• Review publish logs and version histories for any organisation-maintained packages for versions not published by the expected maintainer, and rotate credentials for package registries where rotation has not occurred since June 2026.

P2 (within 72h):

• Require that organisation-originated calls happen on platforms the organisation controls; where an external party insists on their platform or link, treat that as a red flag and escalate.
• Verify recruiters and companies independently before engaging: check company registration status, whether the firm is defunct, and whether the LinkedIn presence is newly created. The June 2026 wave used a defunct Singaporean VC firm and newly created company profiles.
• Enable and enforce multi-factor authentication on all developer accounts with publish rights, and prefer hardware-backed factors over TOTP where the registry supports it, since the observed compromise path was credential theft.
• Review hiring and contractor-onboarding controls for the North Korean IT worker indicators named in the advisory: resumes claiming prestigious education and extensive experience that fail interview scrutiny, repeated refusals to meet in person, video feed interruptions, background voices, requests for payment in cryptocurrency, and visual artifacts from face-swapping software followed by the camera being disabled shortly after a call begins.

P3 (within 7 days):

• Add package-registry integrity monitoring: alert on new versions published outside normal working hours, from new IP ranges, or with new dependency additions, which is how the arrayref malicious versions behaved (an added dependency fetching a remote payload).
• Run a tabletop or walkthrough with development teams covering the fake-interview scenario, using the June 2026 approach as the case study.
• If the organisation suspects it has engaged a fraudulent North Korean IT worker, launch a full forensic investigation and assume credentials and sensitive data have been compromised, per the multi-agency advisory.

5. Indicators of compromise

No indicators of compromise available in the source material. No file hashes, domains, IP addresses, or payload identifiers for the Rust-targeting activity or the arrayref malicious versions appear in the provided sources.

Behavioural indicators:

6. Detection

Insufficient indicators to author detection rules. The sources describe behaviours but contain no strings, file names, command lines, registry keys, mutexes, or hashes belonging to the malicious artefacts themselves.

Threat actor context

Lazarus Group · G0032 · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. …

7. Sources

• Help Net Security, "North Korea's job interview scam runs both ways", https://www.helpnetsecurity.com/2026/09/21/north-korean-hackers-contagious-interview-defenses/, 2026-09-21
• The Register, "Rustaceans warned of job interviews with a malicious payload", https://www.theregister.com/security/2026/09/21/rustaceans-warned-of-job-interviews-with-a-malicious-payload/5297461, 2026-09-21
• The Register, "North Korea's fake job interviews infected 30,000 devices", https://www.theregister.com/security/2026/09/18/north-koreas-fake-job-interviews-infected-30000-devices/5297461, 2026-09-18
• SecurityWeek, "Rust Team Members and Popular Crate Owners Targeted via Video Calls", https://www.securityweek.com/rust-team-members-and-popular-crate-owners-targeted-via-video-calls/, 2026-09
• SecurityWeek, "Rust Supply Chain Attack Linked to North Korean Hackers", https://www.securityweek.com/rust-supply-chain-attack-linked-to-north-korean-hackers/, 2026-09
• The Hacker News, "DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware", https://thehackernews.com/2026/07/dprk-linked-macos-malvertising-uses.html, 2026-07
• Dark Reading, "Red Flags That Expose Fake North Korean IT Workers", https://www.darkreading.com/insider-threats/red-flags-expose-fake-north-korean-it-workers, 2026

8. Adverse Trace position

We assess this as a credible, active threat to any EMEA financial services organisation whose engineers maintain open-source packages or hire remote developers, with the primary risk being malicious code published into a widely depended-upon package after a maintainer credential compromise, as demonstrated by the arrayref incident, and the secondary risk being corporate access via compromised jobseekers and insider risk via fraudulent IT workers. The North Korea attribution for the current Rust wave is unconfirmed and rests on technique comparison rather than shared infrastructure evidence; the broader Contagious Interview / WaterPlum campaign attribution is multi-government corroborated, and the two operations' shared infrastructure and personnel is a finding of the multi-agency advisory. The behavioural indicator set above is drawn from reporting rather than primary artefacts, so it should drive awareness and process controls, not automated enforcement. We will monitor for the release of technical indicators from the Rust Project's security response working group and for follow-on multi-agency reporting, and we will issue an update if IOCs or a confirmed attribution link between the Rust wave and WaterPlum emerges.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.