{"id":54680,"date":"2023-11-21T20:55:00","date_gmt":"2023-11-21T20:55:00","guid":{"rendered":"https:\/\/www.darkreading.com\/threat-intelligence\/dprk-hackers-masquerading-tech-recruiters--job-seekers"},"modified":"2023-11-21T20:55:00","modified_gmt":"2023-11-21T20:55:00","slug":"dprk-hackers-masquerade-as-tech-recruiters-job-seekers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/","title":{"rendered":"DPRK Hackers Masquerade as Tech Recruiters, Job Seekers"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt38d4564d606147cd\/655d0ec83915d1040a4bd9f2\/North_Korea-yogesh_more-Alamy.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<p>North Korean threat actors are posing as both job recruiters and job seekers on the Web, deceiving companies and applicants for financial gain and, possibly, to gain access into Western organizations.<\/p>\n<p>Palo Alto Networks&#8217; Unit 42 this week published the details of <a href=\"https:\/\/unit42.paloaltonetworks.com\/two-campaigns-by-north-korea-bad-actors-target-job-hunters\/\" target=\"_blank\" rel=\"noopener\">two such ongoing campaigns<\/a> it tracks as &#8220;Contagious Interview&#8221; and &#8220;Wagemole.&#8221;<\/p>\n<p>For Contagious Interview, threat actors from the Democratic People&#8217;s Republic of Korea (DPRK) are acting as employers, posting about fake job openings, and engaging with unwitting applicants. Then, during the vetting process, they lure the applicants into installing sophisticated, cross-platform infostealers.<\/p>\n<p>In Wagemole, the baddies switch roles, donning fake personas to apply for jobs at established organizations based in the US and elsewhere.<\/p>\n<p>As Michael Sikorski, chief technology officer and vice president of Unit 42, explains, these elaborate ruses produce much more believable social engineering than your typical phishing email.<\/p>\n<p>&#8220;People are bombarded with emails all day long \u2014 most of those get dumped in the trash bin, or even get flagged as spam. So this is an effort to pivot away and make it seem a lot more realistic,&#8221; he says.<\/p>\n<h2 class=\"regular-text\">Deceiving Job Seekers<\/h2>\n<p>The DPRK has long been a source of creative espionage and financial cybercrime. Besides traditional cyber theft \u2014 <a href=\"https:\/\/www.darkreading.com\/remote-workforce\/north-korea-apt-swindled-1b-crypto-investors-2022\" target=\"_blank\" rel=\"noopener\">for which it is prolific<\/a> \u2014 the army of Kim Jong Un, leader of the country, has also ventured off the beaten path, into domains and with tactics largely unseen elsewhere in the world.<\/p>\n<p>For example, its state-sponsored hackers have posed as recruiters for high-tech jobs, luring developers into sometimes weeks- or monthslong engagements with malware waiting at the end of it. One such case last year led to <a href=\"https:\/\/www.theblock.co\/post\/156038\/how-a-fake-job-offer-took-down-the-worlds-most-popular-crypto-game\" target=\"_blank\" rel=\"noopener\">the heist of Axie Infinity<\/a>, a popular Web3 pay-to-play game, totaling north of half a billion dollars.<\/p>\n<p>Ever since, it seems, the hackers have been trying to repeat that success.<\/p>\n<p>Since at least March, the threat actor behind Contagious Interview has posted vague job openings for software developers or jobs specifically tailored to the AI and Web3 fields. After making initial contact via social media, online forums, or other means, the group invites applicants to an online interview.<\/p>\n<p>It&#8217;s during the interview that the malicious actor sends the applicant an npm-based package hosted on GitHub. This package contains &#8220;Beavertail,&#8221; a heavily obfuscated, JavaScript-based infostealer and loader. It targets basic system information as well as credit card and cryptocurrency wallet details stored in a victim&#8217;s browser. It also retrieves and runs a second payload, &#8220;InvisibleFerret.&#8221;<\/p>\n<p>InvisibleFerret is a Python-based backdoor capable of fingerprinting, keylogging, credential harvesting, data exfiltration, remote control, and, if need be, downloading the AnyDesk RMM for further control over a compromised computer.<\/p>\n<p>Per the <a href=\"https:\/\/www.darkreading.com\/threat-intelligence\/north-korea-bluenoroff-apt-dumbed-down-macos-malware\" target=\"_blank\" rel=\"noopener\">recent trend among capable APTs<\/a>, both Beavertail and InvisibleFerret work across operating systems: Windows, Linux, and macOS.<\/p>\n<p>Interestingly, stealing money and spying on the target may not actually be the primary purpose of either malware. &#8220;By getting them to install malware, [the attackers] then have a foothold on that system. Now, if that person goes and works somewhere else in the future \u2014 they probably will get a real job somewhere else \u2014 then all of a sudden that could lead to an infection into that company&#8217;s supply chain,&#8221; Sikorski suggests.<\/p>\n<h2 class=\"regular-text\">Deceiving Employers<\/h2>\n<p>North Koreans have also for years <a href=\"https:\/\/www.darkreading.com\/careers-and-people\/freelance-market-flooded-with-north-korean-it-actors\" target=\"_blank\" rel=\"noopener\">posed as applicants seeking remote work<\/a> in the tech space. Through a maze of fake resumes, email, social media, websites, and so on, real applicants using fake personas earn work and then <a href=\"https:\/\/www.state.gov\/guidance-on-the-democratic-peoples-republic-of-korea-information-technology-workers\/\" target=\"_blank\" rel=\"noopener\">funnel their earnings back to the Kim regime<\/a>.<\/p>\n<p>While investigating the GitHub infrastructure behind Contagious Interview, the researchers came across evidence of these schemes: longstanding, detailed accounts on GitHub, LinkedIn, freelancer marketplaces, scripts for phone interviews, stolen US permanent resident cards, and more.<\/p>\n<p>It&#8217;s unclear how many of these ersatz IT workers have developed real, long-standing relationships with companies. But just last month <a href=\"https:\/\/www.justice.gov\/opa\/pr\/justice-department-announces-court-authorized-action-disrupt-illicit-revenue-generation\" target=\"_blank\" rel=\"noopener\">the US Department of Justice noted<\/a> that &#8220;this scheme is so prevalent that companies must be vigilant to verify whom they&#8217;re hiring.&#8221;<\/p>\n<p>Companies that hire employees under fake identities don&#8217;t just face a risk of embarrassment, Sikorski warns. &#8220;Just think of the tremendous amount of risk it is to have a state-sponsored actor inside your environment,&#8221; he says. &#8220;And remember: these are software developers, which means they have access to source code.&#8221;<\/p>\n<p>Read More <a href=\"https:\/\/www.darkreading.com\/threat-intelligence\/dprk-hackers-masquerading-tech-recruiters--job-seekers\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>No one has turned the job market into an attack surface quite like North Korea, which plays both sides for financial gain and, possibly, espionage.Read More <a href=\"https:\/\/www.darkreading.com\/threat-intelligence\/dprk-hackers-masquerading-tech-recruiters--job-seekers\">HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-54680","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>DPRK Hackers Masquerade as Tech Recruiters, Job Seekers 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DPRK Hackers Masquerade as Tech Recruiters, Job Seekers 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2023-11-21T20:55:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt38d4564d606147cd\/655d0ec83915d1040a4bd9f2\/North_Korea-yogesh_more-Alamy.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"DPRK Hackers Masquerade as Tech Recruiters, Job Seekers\",\"datePublished\":\"2023-11-21T20:55:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\\\/\"},\"wordCount\":718,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt38d4564d606147cd\\\/655d0ec83915d1040a4bd9f2\\\/North_Korea-yogesh_more-Alamy.jpg\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\\\/\",\"name\":\"DPRK Hackers Masquerade as Tech Recruiters, Job Seekers 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt38d4564d606147cd\\\/655d0ec83915d1040a4bd9f2\\\/North_Korea-yogesh_more-Alamy.jpg\",\"datePublished\":\"2023-11-21T20:55:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\\\/#primaryimage\",\"url\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt38d4564d606147cd\\\/655d0ec83915d1040a4bd9f2\\\/North_Korea-yogesh_more-Alamy.jpg\",\"contentUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt38d4564d606147cd\\\/655d0ec83915d1040a4bd9f2\\\/North_Korea-yogesh_more-Alamy.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"DPRK Hackers Masquerade as Tech Recruiters, Job Seekers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"DPRK Hackers Masquerade as Tech Recruiters, Job Seekers 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/","og_locale":"en_US","og_type":"article","og_title":"DPRK Hackers Masquerade as Tech Recruiters, Job Seekers 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2023-11-21T20:55:00+00:00","og_image":[{"url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt38d4564d606147cd\/655d0ec83915d1040a4bd9f2\/North_Korea-yogesh_more-Alamy.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"DPRK Hackers Masquerade as Tech Recruiters, Job Seekers","datePublished":"2023-11-21T20:55:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/"},"wordCount":718,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt38d4564d606147cd\/655d0ec83915d1040a4bd9f2\/North_Korea-yogesh_more-Alamy.jpg","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/","url":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/","name":"DPRK Hackers Masquerade as Tech Recruiters, Job Seekers 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt38d4564d606147cd\/655d0ec83915d1040a4bd9f2\/North_Korea-yogesh_more-Alamy.jpg","datePublished":"2023-11-21T20:55:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/#primaryimage","url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt38d4564d606147cd\/655d0ec83915d1040a4bd9f2\/North_Korea-yogesh_more-Alamy.jpg","contentUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt38d4564d606147cd\/655d0ec83915d1040a4bd9f2\/North_Korea-yogesh_more-Alamy.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/dprk-hackers-masquerade-as-tech-recruiters-job-seekers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"DPRK Hackers Masquerade as Tech Recruiters, Job Seekers"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/54680","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=54680"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/54680\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=54680"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=54680"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=54680"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}