DeceptiveDevelopment uses spearphishing on job search platforms to distribute malware and steal cryptocurrencies and credentials. Employs infostealers BeaverTail and InvisibleFerret, with techniques similar to other North Korean operations
From 2024, researchers from ESET, a global European leader in the cybersecurity market, have observed a series of malicious activities linked to North Korea, in which attackers, posing as software development recruiters, lure victims with fake job offers. They then trick them into downloading software projects that hide malware designed for information theft. ESET Research has named this attack cluster DeceptiveDevelopment. While it is traced back to North Korea, ESET does not currently attribute it to any known threat actor. The target are freelance software developers, targeted through spearphishing attacks on job search sites and freelance platforms, with the aim of stealing cryptocurrency wallets and login credentials from browsers and password managers.
"As part of a fake selection process, DeceptiveDevelopment operators ask victims to complete a programming test, for example by adding a functionality to an existing project. The files necessary for the task are usually hosted on private repositories on GitHub or similar platforms. Unfortunately for the candidate, these files contain malicious code: once the project is downloaded and executed, the victim's computer is compromised," explains Matěj Havránek, a researcher at ESET who discovered and analyzed DeceptiveDevelopment.
DeceptiveDevelopment's tactics, techniques and procedures are similar to those of other known North Korean operations. Attackers are targeting developers on Windows, Linux and macOS, with the primary goal of stealing cryptocurrencies for financial gain, and with a possible secondary goal of cyber espionage. To connect with victims, operators create fake recruiter profiles on social media. The attack is not targeted at a specific geographical area, but aims to compromise as many victims as possible, thus increasing the chances of stealing funds and information.
DeceptiveDevelopment mainly uses two families of malware, distributed in two phases. In the first phase, BeaverTail (infostealer, downloader) extracts browser databases containing saved credentials and acts as a downloader for the second phase, InvisibleFerret (infostealer, RAT). The latter includes spyware and backdoor components and is capable of downloading AnyDesk remote management software for post-compromise activities.
To pose as recruiters, attackers copy the profiles of real people or create new ones. They then contact victims directly on job search sites and self-employed platforms, or post fake job adverts. Some profiles are created from scratch, while others belong to real people whose accounts have been compromised and modified.
The interactions take place on generic job search platforms and on portals specialized in cryptocurrencies and blockchain, more in line with the attackers' objectives. Sites used include LinkedIn, Upwork, Freelancer.com, We Work Remotely, Moonlight, and Crypto Jobs List.
Victims receive project files directly via transfer to the platform or through a link to repositories such as GitHub, GitLab, or Bitbucket. They are asked to download files, add features or fix bugs, and test the project by running it, at which point the compromise occurs. Attackers employ a sneaky method to hide malicious code: they insert it into a seemingly innocuous component of the project, often in backend code not directly related to the assigned task, adding it as a single line behind a long comment, so that it stays off-screen and goes unnoticed.
“The DeceptiveDevelopment cluster adds to the already wide range of financial schemes used by actors aligned with North Korea and confirms the trend of moving from traditional money to cryptocurrencies,” concludes Havránek.
For a detailed analysis and technical explanation of the DeceptiveDevelopment toolset, see the ESET Research blog post “DeceptiveDevelopment targets freelance developers” on WeLiveSecurity.com and follow ESET Research On Twitter (now X) for updates on the latest news of the ESET search.
