North Korean Hackers Spread BeaverTail Malware Through Fake Crypto Jobs

North Korean hackers are ramping up cyberattacks on the cryptocurrency sector by disguising malware campaigns as fraudulent job opportunities. According to The Hacker News, attackers are tricking unsuspecting job applicants with BeaverTail and InvisibleFerret malware, designed to steal login credentials and crypto wallets.

Unlike earlier campaigns that targeted developers, the new attacks focus on non-technical applicants. Victims are lured through fake job postings and prompted to download malicious files from platforms such as GitHub or Vercel. In some cases, applicants are asked to record a short video on a fake recruitment site. When bogus microphone or camera errors appear, they are instructed to run “fix” commands—actually payloads that install the malware bundle.

This marks a shift in strategy. Previously, BeaverTail required JavaScript or Python to run, limiting its reach. The new version is pre-packaged and ready to execute on both macOS and Windows, broadening its effectiveness. Attackers also use decoy files and password-protected archives to evade security tools, adding another layer of stealth.

Researchers have tied the campaign to North Korea based on BeaverTail’s past use and IP addresses linked to the regime. The activity highlights Pyongyang’s ongoing efforts to exploit crypto firms as a funding source.

Binance CEO Changpeng Zhao recently warned on X (formerly Twitter) about North Korean hackers posing as job candidates, employers, and even regular platform users. Experts advise avoiding suspicious downloads and scripts and treating unexpected technical “errors” during recruitment as red flags.