North Korean-Linked Phishing Emails: How to Recognize Malware and Job Scams

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

Stop if an unexpected recruiter, investor, colleague or “client” asks you to run code, install a trading app, scan an email QR code, lend your identity or host a laptop. Those are the clearest behaviors in current North Korean-linked campaigns. Fake coding tests can install password- and wallet-stealing malware; crypto “opportunities” can lead to trojanized trading software; QR codes can steal cloud sessions even after you use multifactor authentication; and easy freelance gigs can make you an unwitting facilitator for a remote worker using a stolen identity.

An individual message rarely proves who is behind it. Treat the behavior as dangerous regardless of attribution, verify the sender on a second channel, and report suspected activity. If you already ran a file or scanned a QR code, disconnect the device from the internet, leave it powered on, preserve evidence and report promptly.

#	Preview	Product	Price
1		Cybersecurity For Dummies (For Dummies: Learning Made Easy)	$13.53	Buy on Amazon
2		Cybersecurity Terminology & Abbreviations- CompTIA Security Certification: a QuickStudy Laminated...	$7.41	Buy on Amazon
3		CompTIA Security+ Certification Kit: Exam SY0-701 (Sybex Study Guide)	$41.83	Buy on Amazon
4		Cybersecurity All-in-One For Dummies	$25.04	Buy on Amazon
5		How Cybersecurity Really Works: A Hands-On Guide for Total Beginners	$29.94	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

What does a North Korean-linked phishing email usually ask you to do?

The most reliable clue is not a logo, spelling mistake or malware filename. It is the requested action: “please run this.” Official advisories describe unknown Node.js or npm packages, PyPI packages, scripts, GitHub repositories, Visual Studio Code projects, “fixes” for a video call, and non-standard software for a simple task. Other campaigns ask you to install a cryptocurrency application, scan a QR code, or hand over an identity, account or laptop.

North Korean operators use overlapping infrastructure and personnel. Government and security vendors use names such as Lazarus Group, HIDDEN COBRA, TraderTraitor, AppleJeus, WaterPlum, Contagious Interview and Kimsuky for different clusters or activity sets. Those labels are useful for understanding tactics, but they do not let a recipient attribute one email with certainty.

Popular on Amazon

Sale

Cybersecurity For Dummies (For Dummies: Learning Made Easy)

$13.53

Buy on Amazon

• Unknown code in a hiring process: a “technical test” or debugging exercise that requires executing a repository, package or script.
• Unexpected trading software: a recruiter or investor insists that you install a custom portfolio, price-prediction or “update” application.
• A QR code in email: a supposed colleague, embassy, adviser or conference asks you to scan a code and sign in on your phone.
• An easy paid favor: someone offers money to interview for another person, receive a laptop, lend an account or keep a device online.

The FBI says, “North Korean social engineering schemes are complex and elaborate, often compromising victims with sophisticated technical acumen.” It also warns that “Given the scale and persistence of this malicious activity, even those well versed in cybersecurity practices can be vulnerable to North Korea’s determination to compromise networks connected to cryptocurrency assets.”

How do the four main scam paths differ?

All four paths use trust and urgency, but the target and requested action differ. Use this table as a quick triage guide.

How can I spot the fake recruiter or coding-test malware?

WaterPlum, also called Contagious Interview in industry reporting, impersonates legitimate artificial-intelligence, cryptocurrency and non-fungible-token companies or recruiting services. The contact may begin on a job board, social network, freelance marketplace or direct message and progress to a polished technical interview. The decisive warning is a request to execute files from a developer platform or repository to complete the assignment or repair a supposed call problem.

Red flags during the interview

• The recruiter sends an unknown Node.js, npm or PyPI package and says it is required for the test.
• A GitHub or Bitbucket repository contains a project you must open and run immediately.
• A Visual Studio Code folder must be opened and marked trusted, or a configuration is said to “auto-fix” the interview environment.
• You are told to run a script to enable audio or video because of your location.
• The recruiter insists on custom software for an otherwise ordinary call or asks you to move the conversation to another messaging service.
• The compensation is unusually high, the company is difficult to verify, or the recruiter will not confirm the role through an independently found corporate contact.
• The interviewer uses a VPN, has a resume claiming an implausibly broad skill set, refuses an in-person or second-channel verification, or appears to watch another monitor. The WaterPlum advisory also notes mismatched English, background voices, video freezes and requests for cryptocurrency payment or payment to another person’s account.

What malware families are associated with this path?

The stolen material can include browser-stored usernames and passwords, clipboard contents, keystrokes, screenshots, cryptocurrency private keys and seed phrases, plus images of passports or driver’s licenses. Those identity documents can be reused by other North Korean remote IT workers.

The Japan National Police Agency and FBI reported at least 30,000 infected devices in more than 100 countries, including Japan and the United States — Japan NPA and FBI, 2026. The same advisory says attackers accessed more than 7,000 cryptocurrency wallets and transferred at least 1.7 billion Japanese yen (USD 10.71 million) to the DPRK from around December 2025 through July 2026 — Japan NPA and FBI, 2026.

What should I do if a recruiter insists on running an npm package?

1. Stop the interview task and do not execute the package, script, repository or VS Code project.
2. Verify the employer using a phone number or website you found independently, not a link or number supplied in the message. If contact began on a professional network, confirm by live video on a different application or by calling a known number.
3. Never run recruiter code on a work laptop or any computer containing wallet seeds, password-manager data, cloud-console credentials or source-control tokens.
4. If a legitimate assessment truly requires execution, use an isolated virtual machine on a non-company device with no keys or personal data, or use a device supplied by the tester that never connects to your accounts. This reduces exposure; it does not make an unknown file safe.

Is this coding-test malware, or a legitimate assignment?

You cannot determine safety from the package name or a modern-looking repository. A legitimate employer should explain the code’s purpose, provide a reproducible environment and accept a review or live-coding alternative. A demand to disable protections, trust a folder, run an obfuscated script, or troubleshoot a call by executing code is a stop signal.

Also popular on Amazon

Sale

Cybersecurity Terminology & Abbreviations- CompTIA Security Certification: a QuickStudy Laminated Reference Guide

$7.41

Buy on Amazon

The FBI’s indicator list includes requests to execute code or download applications on company-owned devices; “pre-employment tests” involving unknown Node.js, PyPI, scripts or GitHub repositories; unexpected high-paying offers from prominent technology or cryptocurrency firms; unsolicited investment offers; custom software for a simple connection; scripts that supposedly remove regional call restrictions; pressure to move platforms; and unexpected links or attachments.

Do not keep seed phrases, private keys or wallet logins on internet-connected devices. For significant crypto holdings, the FBI recommends allowlisting executables, disabling email attachments by default and requiring multiple unconnected approvers before assets move.

How do TraderTraitor and AppleJeus fake trading apps work?

TraderTraitor is the FBI’s name for a cluster of cryptocurrency-focused activity. AppleJeus is the name used in an earlier CISA/FBI/Treasury advisory for trojanized trading platforms. Both use spearphishing and relationship-building to reach cryptocurrency-company employees, especially DevOps and systems personnel.

What the message and app look like

The sender may pose as a recruiter offering a high-paying role or as an investor offering an opportunity. After rapport is established, the target is directed to a polished website and a cross-platform JavaScript, Node.js or Electron application advertised as a portfolio, trading or price-prediction tool. A bundled routine such as UpdateCheckSync() can pretend to check for updates, download a payload into a temporary directory and execute it. macOS and Windows versions of the custom Manuscrypt remote-access trojan have been observed; some macOS samples carried Apple signatures that were later revoked.

Named examples in the CISA advisory include DAFOM, TokenAIS, CryptAIS and AlticGO, with related Esilet and CreAI Deck branding. Earlier AppleJeus campaigns used Celas Trade Pro, JMT Trading, Union Crypto, Kupay Wallet, CoinGoTrade, Dorusio and Ants2Whale. One phishing email used a fake “Celas LLC” and the domain celasllc[.]com with a valid but weakly verified certificate. A certificate or professional design does not establish legitimacy.

What is the scale?

AppleJeus campaigns had targeted institutions in more than 30 countries during CISA’s 2020–2021 reporting window — CISA, FBI and Treasury, 2021. The FBI attributed approximately USD 1.5 billion stolen from Bybit on or about 21 February 2025 to North Korean activity tracked as TraderTraitor — FBI, 2025. The amount is the FBI’s figure for that incident, not a measure of every North Korean cyber theft.

Also popular on Amazon

Sale

CompTIA Security+ Certification Kit: Exam SY0-701 (Sybex Study Guide)

$41.83

Buy on Amazon

North Korean operators scout professional profiles, use stolen photos and convincing websites, speak fluent or near-fluent English and research firms connected to cryptocurrency exchange-traded funds. The combination of long rapport and domain knowledge is why a familiar conversation can still be malicious.

How should crypto staff respond?

• Confirm the recruiter, investor and software publisher through independently located contacts.
• Do not install a trading or analytics application supplied unexpectedly in a message.
• Use phishing-resistant FIDO2/WebAuthn security keys for email, cloud, source control and VPN access.
• Keep signing keys and wallet seeds off internet-connected computers; use a hardware wallet where appropriate.
• Require multiple, unconnected approvers for transfers and preserve endpoint and identity logs.

Should I scan a QR code from an email?

No, not when the QR code is unsolicited. Kimsuky campaigns use “quishing” to move the victim from a corporate computer to a phone, where normal email URL inspection may not apply. The FBI defines quishing as embedding malicious URLs in QR codes “to force victims to pivot from their corporate endpoint to a mobile device, bypassing traditional email security controls.”

How the Kimsuky flow works

1. A message impersonates a colleague, foreign-policy adviser, embassy employee or conference organizer.
2. The QR code opens a redirector that fingerprints the phone’s user agent, operating system, IP address, locale and screen size.
3. A mobile-optimized page imitates Microsoft 365, Okta, Google or a VPN sign-in.
4. The victim enters credentials and an authentication code. The attacker steals a session token and replays it to access the cloud account.

The FBI warns that “Quishing operations frequently end with session token theft and replay [T1550.004], enabling attackers to bypass multi-factor authentication [T1550.004] and hijack cloud identities without triggering typical “MFA failed” alerts.” A successful MFA prompt therefore does not prove that the login page was genuine.

Examples reported in 2025

• In May, a spoofed foreign adviser sent a think-tank leader a questionnaire QR code about Korean Peninsula developments.
• Another May message impersonated an embassy employee and directed a senior fellow to a “secure drive” QR code concerning North Korean human rights.
• A spoofed think-tank employee sent a QR code leading to Kimsuky infrastructure.
• In June, a strategic advisory firm received a fake conference invitation whose QR registration button led to a false Google login.

Safer QR-code practice

• Do not scan QR codes in unsolicited email, letters, flyers or packages.
• Verify the sender on a second channel before entering any password.
• Use phishing-resistant MFA, especially for remote access and administrator accounts.
• Ask your organization to inspect QR-linked URLs with mobile-device-management or endpoint controls.
• Keep antivirus current on every phone or tablet used to scan codes, and report suspicious messages internally and to the FBI’s Internet Crime Complaint Center.

Could an easy freelance gig make me a North Korean IT-worker facilitator?

Yes. This path is often fraud and sanctions evasion rather than inbox malware, but the lure reaches people who would never consider themselves cyber targets. Fake freelance listings ask financially stressed Americans to interview for another person, receive or host a laptop, share professional accounts, ship packages or complete fingerprint and drug tests.

The FBI says, “The general public needs to be aware that North Korean ITWs increasingly rely on the help of witting and unwitting Americans to acquire jobs in the United States, and they strategically target those under financial stress.” The agency says North Korean IT workers have attempted thousands of U.S. jobs and generate hundreds of millions of dollars annually; the North Korean government receives an estimated 85–90 percent of their revenue — FBI, 2026. Individual workers have been known to earn up to USD 300,000 annually — FBI, Treasury and State, 2022; restated by DOJ, 2026.

Public-facing warning signs

• The “client” pays you to appear on camera, interview or attend meetings as if you were another person.
• You are asked to hand over a professional-network or social-media login, receive packages or keep a company laptop online at your home.
• The story involves a foreign developer who cannot be present in the United States, often with elaborate documents and a temporary-presence explanation.
• You are asked to use your identity, bank account, address, fingerprinting or urinalysis for someone else’s employment.
• The arrangement uses cryptocurrency, another person’s payment account or rapidly changing banks, addresses and social accounts.

Company investigators may find remote-access tools such as AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop or Splashtop Streamer; KVM-over-IP hardware such as TinyPilot, PiKVM or GL.iNet; OBS Studio with VDO.Ninja; Homebrew; daily screen recording; forged IDs; and repeated data transfers. No single indicator proves the scheme. The FBI recommends “identity in depth”: E-Verify, a U.S. passport, multiple identity documents and live verification create friction, while name ban-lists can misidentify identity-theft victims.

Also popular on Amazon

Sale

Cybersecurity All-in-One For Dummies

$25.04

Buy on Amazon

Why participation is dangerous

North Korean IT-worker revenue supports the government, including nuclear weapons and other military programs. In one 2026 Ohio indictment, prosecutors alleged more than 70 U.S. company employers and approximately USD 3 million in revenue. In a separate sentenced case, prosecutors said stolen identities of at least 80 U.S. persons were used at more than 100 companies, generating more than USD 5 million for the DPRK and at least USD 3 million in victim-company damages. Defendants in the Ohio matter remain presumed innocent unless convicted.

Operation Lonestar Roundup in September 2026 involved searches at more than 40 Texas residences and seizure of approximately 187 laptops and KVM devices — U.S. Department of Justice, 2026. The FBI also reports threats against managers and families, threats to release source code and in-person intimidation after termination.

Do not interview for another person, lend an identity or account, host a laptop for someone you do not personally know, or accept payment for those acts. If someone threatens your life or physical safety, call 911. Report the offer to the local FBI field office and the Internet Crime Complaint Center.

What should I do before clicking, scanning or running anything?

1. Pause and verify independently. Find the employer’s official contact details yourself. If the conversation started on a professional network, verify by a different application or a phone number you already had.
2. Separate the test from your secrets. Never use a work laptop or a machine containing password-manager vaults, wallet seeds, cloud-console credentials or source-control tokens. An isolated virtual machine on a non-company device is the minimum safer setup for a legitimate test.
3. Reject unexpected software. Do not install trading apps, custom call tools, browser extensions, update scripts or repository dependencies supplied through an unsolicited message.
4. Protect authentication. Use FIDO2/WebAuthn security keys for email, cloud, source control and VPN. Session theft can defeat ordinary MFA, so do not treat an approval prompt as proof that a page is genuine.
5. Keep high-value secrets offline. Do not store wallet logins, private keys or seed phrases on internet-connected devices.
6. Preserve the message. Save the sender address, headers if available, URLs, attachments, recruiter profile, payment instructions and screenshots before deleting or reporting it.

What if I already ran the file or scanned the QR code?

Act quickly, but do not destroy evidence.

1. Disconnect immediately. Disable Wi-Fi and unplug network cables. Do not power off the device; the FBI advises leaving it powered on to preserve malware artifacts.
2. Use a different clean device. Change passwords for email, source control, cloud services, exchanges and password managers. Revoke active sessions and tokens. Assume browser-stored passwords and wallet extensions may be exposed.
3. Protect funds. Move cryptocurrency only through a documented incident-response plan with trusted, unconnected approvers. Do not paste seed phrases into a potentially compromised computer.
4. Report. File a detailed complaint at https://www.ic3.gov/ and contact your local FBI field office. Include names, email addresses, phone numbers, social accounts, IP addresses, bank details, street addresses where devices were received, screenshots and recruiter or facilitator information.
5. Involve your organization. Security teams should revoke accounts and sessions, preserve endpoint and identity logs, and consult counsel before re-imaging if a criminal referral may follow.
6. Handle threats as emergencies. The FBI states, “Be aware ITWs have used threats of violence and other acts of intimidation to try to compel Americans to continue illicit activities. If you or someone you know receives a threat to life or is concerned about physical safety, call 911.”

How should companies reduce exposure?

Technical controls work best when combined with a hiring process that assumes identity and social-engineering risk.

• Block or quarantine email attachments by default for high-risk teams and allowlist approved executables.
• Require phishing-resistant MFA for email, cloud consoles, source control and VPN; monitor for new sessions and token replay.
• Give candidates a safe coding environment that does not require access to production systems, wallet keys or corporate credentials.
• Verify identity in depth with live checks and multiple documents; do not rely on static name lists.
• Monitor for remote-desktop and KVM-over-IP hardware, unexplained screen recording, unusual residential network access and rapid changes in payment or shipping details.
• Require multiple independent approvals for cryptocurrency transfers and keep signing authority separated.
• Train staff that a QR code is a link, not a security control, and route suspicious messages to a security team.

In a 13 October 2026 statement, Assistant Attorney General for National Security John A. Eisenberg said: “North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or our allies.” FBI Cyber Division Assistant Director Brett Leatherman said: “North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs.” U.S. Attorney Ryan Raybould described the issue this way: “This investigation is about far more than fraud. It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders.”

How do the names Lazarus, TraderTraitor, WaterPlum and Kimsuky relate?

Lazarus Group is an umbrella label associated with Reconnaissance General Bureau activity. HIDDEN COBRA is the U.S. government’s broad label for DPRK malicious cyber activity. TraderTraitor identifies a cryptocurrency-app and theft cluster; APT38, BlueNoroff, BeagleBoyz and Stardust Chollima are overlapping financial-theft labels. WaterPlum and Contagious Interview describe fake-job malware and related IT-worker infiltration associated in the Japan NPA/FBI advisory with the Munitions Industry Department’s 313 General Bureau. Kimsuky is a separate, espionage-focused cluster known for QR-code spearphishing against policy targets.

Also popular on Amazon

Sale

How Cybersecurity Really Works: A Hands-On Guide for Total Beginners

$29.94

Buy on Amazon

CISA and MITRE caution that malware, personnel and infrastructure can be shared. Therefore, the safe reader-level conclusion is behavioral: stop the request, protect accounts and report it rather than trying to prove which alias sent the message.

What related activity should South Korean readers know about?

Industry reporting in October 2026 described a geography-specific Lazarus operation dubbed FlashHole. Messages to South Korean construction, software and wire-communications firms led to fake GitHub Pages résumé or portfolio sites, including a likely AI-generated photograph, and then targeted outdated INISAFE CrossWeb EX financial-security software. This example is related but should not be conflated with the four primary campaigns above; the same defenses—independent verification, no unsolicited code and prompt reporting—still apply.

Where can I report a suspected North Korean-linked scam?

Use the Internet Crime Complaint Center for online crime reports and contact your local FBI field office. Include preserved messages, account names, phone numbers, URLs, wallet addresses, payment details and device information. For an immediate threat to life, call 911. The State Department’s Rewards for Justice program may offer rewards of up to USD 5 million for information disrupting specified DPRK illicit finance, including cybercrime.

Frequently Asked Questions

Can a QR code steal my account even if I use MFA?

Yes. A QR-linked page can collect a session token after you authenticate, allowing replay of the existing session without generating a normal failed-MFA event. Revoke sessions from a clean device and ask your security team to review sign-in and token logs.

Should I send a suspicious coding-test repository to my security team?

Send the link or archive through your organization’s approved reporting channel rather than opening it on your own computer. Include the recruiter profile, message headers, requested commands and any deadline or payment pressure.

What if I accepted a laptop-hosting job but have not connected the laptop?

Do not power it on, connect it to a network or return it through an untracked shipment. Isolate it, preserve the delivery details and contact the FBI or your local law-enforcement agency for instructions; document every person, address and payment account involved.

Are North Korean phishing emails always written with poor grammar?

No. Current campaigns may use fluent or near-fluent English, stolen photographs, convincing company sites and detailed knowledge of cryptocurrency or policy work. The requested action and independent verification matter more than writing style.

Quick Recap

SaleBestseller No. 1

Cybersecurity For Dummies (For Dummies: Learning Made Easy)

$13.53

SaleBestseller No. 2

Cybersecurity Terminology & Abbreviations- CompTIA Security Certification: a QuickStudy Laminated Reference Guide

$7.41

SaleBestseller No. 3

CompTIA Security+ Certification Kit: Exam SY0-701 (Sybex Study Guide)

$41.83

SaleBestseller No. 4

Cybersecurity All-in-One For Dummies

$25.04

SaleBestseller No. 5

How Cybersecurity Really Works: A Hands-On Guide for Total Beginners

$29.94

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.