Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The fastest way to spot a North Korean-linked phishing scam is to focus on the requested action, not the logo or fluent English. Stop when a recruiter asks you to run an unknown npm, PyPI or GitHub project; install a trading application; scan a QR code in an email; or lend your identity, accounts or home to a remote worker. Those lures map to four documented campaigns: WaterPlum/Contagious Interview malware, TraderTraitor and AppleJeus crypto theft, Kimsuky QR-code spearphishing, and fraudulent North Korean IT-worker recruitment.
No single email proves state attribution. Treat the behaviors below as an immediate security incident regardless of who is behind the message, verify every contact on a separate channel, and never expose a work device or cryptocurrency keys to an unsolicited “test.”
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What are North Korean-linked phishing emails trying to make you do?
Most of these operations are social-engineering campaigns that end with a seemingly ordinary request: run this coding exercise, install this “trading” program, scan this QR code, or help a foreign worker get a job. The request is the durable indicator; package names, domains, sender accounts and malware hashes change frequently.
U.S. and allied agencies use overlapping names for related activity. Lazarus Group is an umbrella label for activity associated with North Korea’s Reconnaissance General Bureau; HIDDEN COBRA is the U.S. government’s broad label for malicious DPRK cyber activity. TraderTraitor is the FBI/CISA name for a crypto-app and theft cluster, while APT38, BlueNoroff, BeagleBoyz and Stardust Chollima are financial-theft labels that overlap with Lazarus. WaterPlum, Contagious Interview and the cluster that CrowdStrike calls Famous Chollima are associated with fake-job malware and IT-worker infiltration. Kimsuky is a separate, espionage-focused cluster that has used QR spearphishing against policy targets. Personnel, malware and infrastructure can be shared, so attributing one message to a particular unit is usually uncertain.
Popular on Amazon
The FBI describes the social engineering plainly: “North Korean social engineering schemes are complex and elaborate, often compromising victims with sophisticated technical acumen.” A convincing profile, polished website or technically correct conversation is not a safety signal.
How do the four main scam paths differ?
Use this comparison to match the message you received to the right defensive response. The “prize” is what the operator is trying to obtain, not what the victim is promised.
| Campaign type | Who is in the inbox | What they ask | Payload or outcome | Best immediate defense |
|---|---|---|---|---|
| WaterPlum / Contagious Interview | Fake employer, recruiter or recruiting service | Download a repository, npm package or Visual Studio Code project; “fix” a video call | BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle steal browser data, keys and identity documents | Never run recruiter code on a device containing keys or company access; independently verify the employer |
| TraderTraitor / AppleJeus | Fake recruiter or investor targeting crypto, DevOps and systems staff | Install a trading or price-prediction application, or run an “update” | Electron/Node apps deploy remote-access malware such as Manuscrypt to steal private keys and enable fraudulent transactions | Verify the company through a known contact path and refuse unsolicited trading software |
| Kimsuky quishing | Spoofed colleague, embassy employee, adviser or conference organiser | Scan a QR code and sign in on a phone | Mobile credential-harvest pages steal passwords and session tokens that can be replayed to bypass normal MFA alerts | Do not scan QR codes from unsolicited email; verify on another channel and use phishing-resistant MFA |
| IT-worker facilitator scam | Fake freelance client contacting a financially stressed job seeker | Interview for another person, host a laptop, lend an account or identity, ship packages or complete screening | Remote-access and KVM equipment gives a North Korean worker covert access; the facilitator can face fraud, sanctions and intimidation consequences | Refuse identity lending, interviews for others and laptop hosting; report the approach |
How can I spot a fake recruiter LinkedIn malware or Contagious Interview scam?
In the WaterPlum campaign, the “interview” is a delivery mechanism. The contact may impersonate an AI, cryptocurrency or NFT company or a recruiting service, then move the conversation from a social network or job platform to a technical interview and coding assignment.
The decisive warning: “please run this”
During the interview, the supposed employer provides a repository or file and asks you to execute it to complete a test. A second version claims that your video call is broken and asks you to run a script or install non-standard software to enable audio or video. Unknown Node.js or npm packages, PyPI packages, scripts, GitHub repositories and a Visual Studio Code folder that asks you to trust the workspace all belong in the stop-now category.
StoatWaffle is a modular Node.js family delivered as a malicious Visual Studio Code project. A blockchain-themed repository can contain a configuration that runs automatically after the folder is opened and trusted. BeaverTail hides JavaScript malware in npm packages and can be downloaded from GitHub or Bitbucket. InvisibleFerret is a Python backdoor. OtterCookie is a JavaScript remote-access trojan and infostealer; OtterCandy combines OtterCookie with RATatouille features.
What the malware takes
- Browser-stored passwords, authentication cookies and account identifiers.
- Clipboard contents, keystrokes and screenshots.
- Cryptocurrency wallet private keys and seed phrases.
- Photographs of passports, driving licences and other identity documents that can be reused by additional North Korean IT workers.
Package names and command-and-control addresses rotate, so a clean-looking repository or a recently created account does not clear the test. The behavioral test is simpler: a legitimate recruiter should not require executable code from an unknown source on a machine that contains your credentials.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchInterview details that should raise the risk score
- A resume claims an implausibly broad skill set and a career that jumps rapidly between European and Asian employers.
- The contact refuses an in-person meeting, insists on a VPN connection to the application process, or pushes payment in cryptocurrency or to another person’s account.
- You see glances toward another monitor, unexplained background voices, or repeated video and audio freezes.
- The recruiter moves the conversation to a different messaging platform and sends unexpected links or attachments.
None of these clues is conclusive by itself. Together with a request to execute code, they are enough to decline and report.
Also popular on Amazon
Is this coding test malware?
Assume it may be when the exercise requires an unknown package, script, repository or IDE configuration to run locally. A coding test can be legitimate, but there is no hiring reason to place your password vault, wallet extensions, cloud credentials or source-control tokens at risk.
- Ask for the assignment in plain text or a non-executable archive and inspect it without opening or trusting the project.
- Confirm the company and recruiter through a phone number, domain or video contact you obtained independently, not through the message.
- If a test is unavoidable, use an isolated virtual machine on a non-company device that has never held wallet seeds, password-manager data, cloud-console credentials or source-control tokens. Do not copy secrets into the environment.
- Refuse any request to disable endpoint protection, install a custom “video fix,” or grant an IDE permission to run tasks automatically.
The FBI’s own indicator list includes requests to execute code on company-owned devices, “pre-employment” debugging with non-standard Node.js or PyPI packages, unexpected high-paying offers from prominent technology or cryptocurrency firms, unsolicited investment offers, custom software for a simple call, scripts that supposedly fix location-based video restrictions, and unexpected links or attachments.
How do TraderTraitor and AppleJeus fake trading apps steal cryptocurrency?
TraderTraitor and AppleJeus target cryptocurrency exchanges, Web3 companies, large holders, DevOps staff and system administrators. Their opening message often looks like a recruitment pitch for a high-paying role, followed by a request to download a modern-looking trading or price-prediction application.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhat the application does
The programs are commonly cross-platform JavaScript, Node.js or Electron applications advertised on polished websites. A bundled routine such as UpdateCheckSync() can pretend to check for updates, download a second payload to a temporary directory and execute it. Observed payloads include macOS and Windows variants of Manuscrypt, a custom remote-access trojan. Some macOS samples carried Apple signatures that were later revoked; a signature is not proof that the application is safe.
Government advisories have named fake products including DAFOM, TokenAIS, CryptAIS and AlticGO, along with Celas Trade Pro, JMT Trading, Union Crypto, Kupay Wallet, CoinGoTrade, Dorusio and Ants2Whale. These names are historical examples, not a safe-list. A new brand, valid HTTPS certificate or impressive price chart can be part of the lure.
Why crypto employees are selected
FBI reporting says operators scout professional-networking sites, build rapport over time, use stolen photographs and fluent or near-fluent English, and research companies connected to cryptocurrency exchange-traded funds. “The messages often mimic a recruitment effort and offer high-paying jobs to entice the recipients to download malware-laced cryptocurrency applications.”
The parallel theft track is measurable. North Korea stole approximately USD 1.5 billion in virtual assets from Bybit on or about 21 February 2025 — FBI, 2025. CISA’s AppleJeus advisory recorded campaigns targeting institutions in more than 30 countries during its 2020–2021 reporting window — CISA, FBI and Treasury, 2021.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Also popular on Amazon
Protection for crypto staff and holders
- Verify the recruiter, investor or software vendor through a contact method already stored in your records.
- Do not install unsolicited trading, portfolio or price-prediction software on a workstation that can reach wallets, exchanges or internal networks.
- Keep seed phrases and private keys off internet-connected devices, as the FBI advises.
- For firms holding substantial assets, allowlist approved executables, disable email attachments by default and require multiple unconnected approvers before moving funds.
- Use phishing-resistant FIDO2/WebAuthn authentication for email, cloud, source control, exchange administration and VPN access.
Should I scan this QR code from an email?
No, not when the QR code arrived unexpectedly in email, a letter, a flyer or packaging. Kimsuky’s quishing campaigns move the victim from a managed computer to a phone, where normal email filtering cannot inspect the destination as effectively.
How the Kimsuky flow works
An email may appear to come from a foreign-policy adviser, embassy employee, colleague or conference organiser. The QR code leads through redirectors that fingerprint the phone’s user agent, operating system, IP address, locale and screen size. The final page is a mobile-optimised imitation of Microsoft 365, Okta, Google or a VPN sign-in.
The FBI defines the technique this way: “Quishing (QR Code Phishing) is a phishing technique in which adversaries embed malicious URLs inside QR codes to force victims to pivot from their corporate endpoint to a mobile device, bypassing traditional email security controls.” The agency also warns: “Quishing operations frequently end with session token theft and replay [T1550.004], enabling attackers to bypass multifactor authentication [T1550.004] and hijack cloud identities without triggering typical ‘MFA failed’ alerts.”
Examples reported in 2025
- In May, a spoofed foreign adviser sent a think-tank leader a QR “questionnaire” about Korean Peninsula developments.
- Another May message impersonated an embassy employee and offered a QR link to a supposed secure drive concerning North Korean human rights.
- A spoofed think-tank employee sent a QR code that led to Kimsuky infrastructure.
- In June, a fake strategic-advisory conference invitation used a QR registration button that opened a counterfeit Google login.
Verify the sender using a phone number or meeting channel you already trust before any login. Keep antivirus current on phones used for scanning, have endpoint or mobile-management tools inspect QR destinations where possible, and prefer phishing-resistant MFA rather than relying on a one-time code.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What is the North Korean IT-worker laptop-farm scam?
This is often not an inbox malware attack at all. A fake freelance client offers easy money to a financially stressed person who is asked to interview for someone else, receive a company laptop, host it at home, share a professional account, ship packages or complete fingerprint and drug tests.
The FBI’s 13 October 2026 warning says, “The general public needs to be aware that North Korean ITWs increasingly rely on the help of witting and unwitting Americans to acquire jobs in the United States, and they strategically target those under financial stress.” The work can involve remote-access software, KVM-over-IP hardware and daily screen recording so the overseas worker appears to operate from a U.S. residence.
Public-facing signs
- A “client” supplies an elaborate backstory about being unable to work in the United States, often citing an East Asian nationality or displacement from the Russia–Ukraine war.
- You are paid to appear on camera, join an interview or meeting, verify a false identity, or keep a device online at your home.
- The person requests your social or professional-network login, bank account, address, phone number or identity documents.
- The arrangement requires shipping equipment, receiving packages, completing tests for someone else or concealing who actually performs the work.
- After a contract ends, the operator threatens managers or their families, threatens to publish source code or sends someone to intimidate a facilitator.
Do not interview for another person, lend an identity or account, or host a laptop for someone you do not personally know. These actions can create fraud and sanctions exposure even if you believed the story, and they can leave you subject to law-enforcement scrutiny.
Also popular on Amazon
What companies see on a compromised laptop
Company investigators may find remote-desktop tools such as AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop or Splashtop Streamer; KVM equipment such as TinyPilot, PiKVM or GL.iNet devices; OBS Studio with VDO.Ninja; Homebrew; daily screen recordings; rapidly changing bank accounts, addresses and social profiles; and forged identity documents. The FBI recommends “identity in depth”: combine E-Verify, a U.S. passport or multiple identity documents with live verification rather than relying on a single indicator or a name blacklist that could harm identity-theft victims.
Why does this matter beyond one stolen account?
North Korean cybercrime and labor fraud finance the state. The FBI estimates that the government receives 85–90 percent of the revenue generated by North Korean IT workers — FBI, 2026. Thousands have attempted U.S. employment, producing hundreds of millions of dollars annually; an individual worker has been reported to earn up to USD 300,000 per year — FBI, Treasury and State joint advisory, 2022, restated by the Department of Justice in 2026.
The scale of the fake-job malware campaign is also broad: at least 30,000 devices in more than 100 countries and more than 7,000 cryptocurrency wallets were affected from around December 2025 through July 2026. At least 1.7 billion Japanese yen, equivalent to USD 10.71 million, was transferred to the DPRK during that period — Japan National Police Agency and FBI, 2026.
Recent U.S. cases show the facilitator risk. A 2026 Ohio indictment alleges more than 70 U.S. company employers and approximately USD 3 million in revenue. In a separate sentenced scheme, stolen identities of at least 80 U.S. persons were used at more than 100 companies, generating more than USD 5 million for the DPRK and at least USD 3 million in victim-company damages — Department of Justice, 2026. Operation Lonestar Roundup in September 2026 involved searches at more than 40 Texas residences and seizure of approximately 187 laptops and KVM devices — Department of Justice, 2026. Allegations remain allegations unless and until proved in court.
John A. Eisenberg, Assistant Attorney General for National Security, said on 13 October 2026: “North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or our allies.”
What should I do before clicking, running or scanning?
Use a deliberate pause. The following sequence protects both individual accounts and company evidence.
- Verify independently. If the contact began on LinkedIn or a job board, call a number already in the company’s records or arrange a live video conversation on a different application. Do not use a number or link supplied only by the sender.
- Separate the test from your secrets. Never run recruiter code on a work laptop or on a computer containing wallet seeds, password-manager vaults, cloud consoles or source-control tokens. If you proceed with a legitimate exercise, use an isolated virtual machine on a clean, non-company device.
- Keep keys offline. Do not store seed phrases or private keys on internet-connected devices.
- Harden sign-in. Deploy phishing-resistant FIDO2/WebAuthn security keys for email, cloud, source control and VPN. A one-time code does not stop a stolen session token.
- Refuse identity and equipment requests. Do not interview for another person, receive a laptop for an unknown worker, share an account or accept payment for concealing who performs the job.
What if I already ran the file or scanned the QR code?
Act as though credentials and session data may be exposed. Do not wait for a visible symptom.
Also popular on Amazon
- Disconnect immediately. Remove the device from wired and wireless networks. Follow the FBI instruction to leave it powered on so malware artifacts and volatile evidence are preserved; do not casually shut it down or wipe it.
- Use a different, clean device. Change passwords for email, GitHub, cloud services, exchanges and password managers, then revoke active sessions and tokens. Assume browser-stored passwords and wallet extensions may have been copied; move cryptocurrency to a newly created, protected wallet after consulting qualified incident responders.
- Preserve identifiers. Save screenshots, sender addresses, profile URLs, phone numbers, wallet addresses, repository links, QR images, shipping addresses, bank details and any threatening messages.
- Report promptly. File a detailed complaint with the Internet Crime Complaint Center (IC3) and contact your local FBI field office. Companies should revoke accounts and sessions, preserve logs and involve counsel before re-imaging if a criminal referral is possible.
- Protect people. If anyone threatens your life or physical safety, call 911. The FBI specifically warns that IT workers have used threats of violence and intimidation to force Americans to continue illegal activity.
Are there related campaigns I should know about?
In October 2026, industry reporting described a geography-specific Lazarus operation dubbed Operation FlashHole. Spearphishing emails to South Korean construction, software and wire-communications companies linked to fake GitHub Pages résumé or portfolio sites, sometimes using likely AI-generated photographs, and then exploited outdated INISAFE CrossWeb EX financial-security software. It is a related example, not a reason to treat every GitHub link as malicious; the primary defenses remain independent verification, software updates and refusing unsolicited execution.
How were these campaigns selected?
The four paths above are the ones repeatedly described in FBI, IC3, CISA, Japan National Police Agency, Australian Cyber Security Centre, German BND/BfV and U.S. Department of Justice advisories through October 2026. They cover the main lures a reader is likely to encounter: executable coding tests, fake trading software, QR-based credential theft and paid identity or laptop facilitation. The selection emphasizes the requested behavior, the information or access sought, and the official mitigation that stops the chain before malware or an insider foothold is established.
Frequently Asked Questions
How can I verify a recruiter who contacted me on LinkedIn?
Find the company’s website and telephone number independently, then contact its recruiting or security team without using the message’s links. Ask whether the named employee, vacancy and coding exercise exist, and use a separate live-video or phone channel before downloading anything.
Can multifactor authentication stop a QR-code phishing attack?
A normal one-time code may not help if the attacker steals and replays an authenticated session token. Use phishing-resistant FIDO2/WebAuthn authentication and revoke sessions immediately if you entered credentials on a QR-linked page.
Is it illegal to receive a laptop for a remote worker?
The FBI says identity lending, interviewing for another person and hosting a laptop for an unknown worker can support fraud and sanctions evasion and expose the helper to law-enforcement scrutiny. Decline the offer and report the recruiter rather than returning equipment privately.
What evidence should a company preserve after a suspected North Korean intrusion?
Preserve the original device, volatile data, email headers, repository and download links, authentication logs, endpoint alerts, wallet addresses, shipping records and all communications. Revoke sessions and isolate accounts, but involve counsel and incident responders before re-imaging when a criminal referral may follow.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
