ESET Research has released new findings on DeceptiveDevelopment, also known as Contagious Interview – a threat group aligned with North Korea that has grown increasingly active in recent years. The group is primarily focused on cryptocurrency theft, targeting freelance developers across Windows, Linux, and macOS platforms. The newly published research paper traces the group’s evolution from early malware families to more advanced toolsets. These campaigns rely heavily on sophisticated social engineering tactics, including fake job interviews and the ClickFix technique, to deliver malware and exfiltrate cryptocurrency. ESET also analyzed open-source intelligence (OSINT) data that sheds light on the operations of North Korean IT workers involved in fraudulent employment schemes and their ties to DeceptiveDevelopment. These findings are being presented today at the annual Virus Bulletin (VB) Conference.
DeceptiveDevelopment is a North Korea-aligned group active since at least 2023, focused on financial gain. The group targets software developers on all major systems – Windows, Linux, and macOS – and especially those in cryptocurrency and Web3 projects. Initial access is achieved exclusively via various social engineering techniques like ClickFix, and fake recruiter profiles similar to Lazarus’s Operation DreamJob to deliver trojanized codebases during staged job interviews. Its most typical payloads are the BeaverTail, OtterCookie, and WeaselStore infostealers, and the InvisibleFerret modular RAT.
The attackers opted for various methods to compromise users, relying on clever social engineering tricks. Via both fake and hijacked profiles, they pose as recruiters on platforms like LinkedIn, Upwork, Freelancer.com, and Crypto Jobs List. They offer fake lucrative job opportunities in order to attract their target’s interest. Victims are requested to participate in a coding challenge or pre-interview task.
In addition to fake recruiter accounts, the attackers have customized and improved the social engineering method called ClickFix. Victims are lured to a fake job interview site and asked to fill out a detailed application form, investing significant time and effort. At the final step, they’re prompted to record a video answer, but the site displays a camera error and offers a “How to fix” link. This link instructs users to open a terminal and copy a command that should solve the camera or microphone issue, which instead of fixing the issue, downloads and executes malware.
While research into DeceptiveDevelopment is primarily based on data from ESET telemetry and reverse-engineering the group’s toolset, it is interesting to point out its connections to fraud operations by North Korean IT workers. According to the FBI’s “Most Wanted” poster, the IT worker campaign has been ongoing since at least April 2017 and has become increasingly prominent in recent years. In a joint advisory released in May 2022, the IT worker campaign is described as a coordinated effort by North Korea-aligned workers to gain employment at overseas companies, whose salaries are then used as funding for the regime. They have also been known to steal internal company data and use it for extortion, as stated in an announcement by the FBI in January 2025.
As ESET Research discovered from available OSINT data, fake CVs, and other related materials, the IT workers mainly focus on employment and contract work in the West, specifically prioritizing the United States. However, our findings based on the acquired materials have shown a shift toward Europe, with targets in countries such as France, Poland, Ukraine, and Albania. The workers utilize AI to perform their job tasks and rely heavily on AI for manipulating photos in their profile pictures and CVs, and even perform face swaps in real-time video interviews to look like the persona they are currently using. They utilize remote interviewing platforms like Zoom, MiroTalk, FreeConference, or Microsoft Teams for various social engineering techniques. Proxy interviewing poses a severe risk to employers, since hiring of an illegitimate employee from a sanctioned country may not only be irresponsible or underperforming, but could also evolve into a dangerous insider threat.
The research paper “DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception” summarizes the evolution of the group’s two flagship toolsets, InvisibleFerret and BeaverTail. At the same time, it identifies newly discovered links between DeceptiveDevelopment’s Tropidoor backdoor and the PostNapTea RAT used by the Lazarus group. Furthermore, it provides a comprehensive analysis of TsunamiKit and WeaselStore, new toolkits used by DeceptiveDevelopment and documents the functionality of a WeaselStore C&C server and its API.
For a more detailed analysis of DeceptiveDevelopment operations and tools, check out the latest ESET Research white paper “DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception” or the brief accompanying blogpost on WeLiveSecurity.com. M
Unrelenting IT issues cost millions of hours in lost productivity
Posted in Commentary with tags Nexthink on September 30, 2025 by itnerdNexthink has released ‘Cracking the DEX Equation: The Annual Workplace Productivity Report’ showing that poor DEX directly costs global businesses an average of 470,000 hours per year, equivalent to around 226 full-time employees. This indicates that digital friction is a vital and underreported element of the global productivity crisis.
Nexthink’s analysis – the first of its kind – is based on proprietary data from more than 20m endpoints across 474 global businesses. The report finds that the average employee suffers 14 negative digital experiences a week. These include device crashes, application glitches, or slow load times, and can reduce productivity and collaboration while also increasing employee frustration and stress. Crucially, the research also indicates a strong inverse correlation between an organization’s DEX score and productivity loss. For every 10-point increase to the overall DEX score, employees would recoup an average of 22 productive minutes each week.
The research also suggests that these consistent disruptions are not just a threat to enterprise productivity, but also to the quality of work employees produce. The average negative event lasts a little under 3 minutes (167 seconds), yet research from the American Psychological Association suggests that even delays of less than 5 seconds are enough to triple people’s error rate. Moreover, research from the University of California has shown that when employees are taken out of their flow state it takes around 23 minutes for them to return, further increasing the amount of lost time.
Averaging lost time by industry shows significant variation with retailers, healthcare providers, and financial service companies suffering 1.7x the time loss of the tech industry. The number of disruptive events per week was almost identical, regardless of industry however, suggesting that the variance in time loss is down to the severity of events rather than the volume.
The figures in this report are derived from aggregated, anonymized telemetry from organizations largely in the early stages of DEX management.
For more information on the impact of DEX on workplace productivity, please read the full ‘Workplace Productivity’ report
Leave a comment »