North Korean hackers are now targeting crypto developers with fake coding tests.
A new campaign by the threat group Slow Pisces (also known as Jade Sleet or TraderTraitor) is exploiting developers—especially in the crypto space—by disguising Python-based malware as take-home coding assignments.
Their tactic?
Start a conversation on LinkedIn. Pose as a hiring manager.
Then, send a “challenge” hosted on GitHub.
What looks like a project to fetch crypto prices? Actually a trojanized package designed to steal sensitive data from macOS machines.
Here’s what the malware (RN Loader + RN Stealer) does:
- Sends basic system info to a remote server
- Downloads a second-stage payload only to validated victims (based on IP, geo, headers)
- Harvests iCloud Keychain, AWS/Kubernetes configs, SSH keys, and more
They’ve even disguised JavaScript challenges the same way—with GitHub repos that trigger arbitrary code execution using embedded templating tools like ejs.render().
What makes this campaign particularly dangerous:
- Payloads are delivered only in memory
- Deserialization tricks bypass typical detection (YAML, EJS)
- No operational overlap with other NK campaigns, but same playbook: “You’re hired. Just complete this challenge.”
This is not a mass phishing campaign. It’s surgical social engineering—aimed at high-value targets in blockchain, security, and cloud tech.
At @Efani, we see this as another reminder:
Your team’s trust in common tools—GitHub, LinkedIn, code samples—can be turned against them.
Cyber vigilance starts with verifying the source.