North Korean Cyber Operatives Infiltrate Crypto Jobs via AI Hiring Tools
Secret footage from a rigged laptop reveals how North Korean spies are bypassing traditional security measures. The Lazarus Group, linked to Pyongyang, was caught live by researchers at BCA LTD, NorthScan, and ANY.RUN after being lured into a booby-trapped developer workstation.
The operation exposed a new tactic: state-backed hackers are infiltrating target companies through legitimate hiring pipelines. By posing as recruiters—in this case, an alias named "Aaron"—they steer victims toward remote work arrangements common in Web3, avoiding malware payloads in favor of direct access.
Researchers deployed a honeypot mimicking a US-based developer’s machine, capturing the group’s tradecraft in real time. The footage highlights how cybercriminals exploit cloud services and AI-driven recruitment platforms to blend into target environments undetected.
