Lazarus, a North Korean state-sponsored group, is contacting software developers on LinkedIn and pretending to be recruiters from companies like Capital One. They ask candidates to complete a coding exercise that looks legitimate but contains hidden malware. When the developer runs the test on their laptop, the malware installs itself and connects back to the attacker. If that laptop belongs to your company, the attacker now has a way in.
Why this matters if you employ developers
The attack works because the candidate is told they have 15 minutes to find a bug in a Python password manager application. That time pressure makes it less likely they will notice anything suspicious in the code. The malware is hidden using base64 obfuscation, and once executed, it connects to a command and control server and waits for instructions.
If your developer uses their work laptop to take the test, the attacker can access your code repositories, harvest credentials, and move into other systems. Lazarus is specifically looking for source code and access to development projects. Stealing that code helps North Korea build technology it cannot otherwise acquire because of sanctions, and it lets the group find vulnerabilities they can exploit in future attacks.
This is not just a developer problem. If one person on your team installs malware, that malware can spread. It can reach customer data, financial records, and anything else on your network.
The broader pattern of fake employees and insider access
The fake coding test is part of a wider campaign. Lazarus has been targeting software developers since August 2023 using spearphishing and fake job offer documents. The FBI has been warning about North Korea using this tactic since 2022.
In at least one case, a cybersecurity company called KnowBe4 hired someone who turned out to be a North Korean threat actor. The person used AI tools to alter their appearance during video interviews. Once hired, they installed malware on their company laptop. KnowBe4 caught it and contacted the FBI, who confirmed the new employee was a state-sponsored attacker.
The FBI says there have been multiple cases of North Korea-based IT workers who successfully hid their identities and got jobs with Western companies. The paychecks fund weapons programs and cyber operations, and the workers collect intelligence while employed.
What to do if your team includes developers
Tell your developers not to run code from job applications on their work laptops. If they want to complete a coding test, they should do it on a personal device or in a virtual machine that is isolated from your network.
Make it standard practice to verify recruiter identities. If someone contacts your team on LinkedIn claiming to represent a well-known company, your developer should confirm that directly with the company before engaging. LinkedIn profiles can be fake, and the person on the other end of a video call may not be who they claim to be.
If you have remote access to code repositories or cloud development environments, make sure those are protected with multi-factor authentication. That way, even if a credential is stolen, the attacker cannot get in without the second factor.
What this means for businesses without developers
If you do not employ developers and no one on your team writes code, this specific attack does not apply to you. But the underlying tactic does. Attackers are getting better at impersonating recruiters, colleagues, and vendors to trick people into running malicious files.
The same principle applies to any email or message that asks someone on your team to download and open a file. That file could be a resume, an invoice, a contract, or anything else that looks normal. Training your team to pause and verify before opening attachments is worth doing, regardless of your industry.
How monitoring catches this before it spreads
If malware does get onto a device, the next step is usually a connection to a command and control server. That connection is detectable. Monitoring tools can see when a device on your network starts communicating with a suspicious IP address or domain, and they can block it or alert you before the attacker does anything else.
Most small and mid-sized businesses do not have someone watching for those signals around the clock. That is what managed detection and response is for. It monitors your environment continuously and responds when something suspicious happens, so you do not have to figure out whether a new connection is normal or not.
