North Korean Hackers Use Fake Coding Interviews to Steal Developer Credentials
Elastic Security Labs uncovered a DPRK‑aligned campaign that lured developers on Slack with fake coding‑interview jobs, then delivered a trojanized repository hidden inside SVG images. The payload steals browser passwords, crypto wallets, files and installs a Socket.IO remote‑access backdoor. Compromising a single developer gives attackers footholds for broader supply‑chain attacks.