Fake Crypto Job Interview Scams

How the Fake Crypto Job Interview Scam Works

The approach looks like ordinary recruiting. A recruiter finds you through social media, a job board or a freelance marketplace, often claiming to hire for an AI, crypto or NFT company. A joint advisory from police and intelligence agencies in Japan, the United States, Australia and Germany describes the next step: a technical interview or coding assignment in which the candidate is told to download and run files from a code repository, either to complete the task or to troubleshoot an error in the video conferencing platform.

The file usually arrives as a Node Package Manager (npm) package, the standard way JavaScript developers install other people's code, or as a Visual Studio Code project. The advisory describes one malware family that hides a configuration file which runs automatically when the folder is opened and trusted. Nothing has to look suspicious, because you are doing exactly what a real candidate would do.

Developers are not the only targets. Sekoia documented a variant aimed at business development and asset management roles: a polished interview website reports that access to your camera or microphone is blocked, then offers a command to paste into a terminal to repair the driver. That command is the infection.

What the Malware Takes

The advisory lists what gets sent to the attackers: logins saved in web browsers, clipboard contents, keystrokes, screenshots, identity documents and wallet data including private keys and seed phrases (the list of words that recreates a wallet). Palo Alto Networks' Unit 42 research found the BeaverTail malware searching browsers for wallet extensions including MetaMask, Phantom and Coinbase.

That is what separates this from a wallet drainer, which needs you to sign a malicious permission. Here the attacker takes the keys and signs whatever they like. It also differs from a pig butchering scam, where you send the money yourself.

Who Runs These Campaigns

Attribution here is a government finding. The advisory assesses the group, which it calls WaterPlum and security firms call Contagious Interview, as operating under a North Korean state bureau. It states that between December 2025 and July 2026 the group exploited at least 30,000 computers in over 100 countries, took funds or credentials from more than 7,000 wallets and moved at least 10.71 million dollars in crypto to North Korea. The FBI had already warned in 2024 that North Korean teams study targets' professional networking activity and use fake job offers and pre-employment tests.

Red Flags and Rules That Protect You

Rules beat judgment, because the people running this are practised at seeming normal. The FBI lists three red flags: requests to run code or download applications, requests to move the conversation to another messaging app, and unexpected links or attachments.

Never run a recruiter's code on the machine that holds your wallets. The advisory says to run unknown code only in a sandbox or virtual machine. In VS Code, answer No to the trust prompt: Restricted Mode stops tasks and debugging from running until you trust the folder.

Never paste a terminal command to fix a camera for an interview. A real video call works without one.

If you ran something, treat the wallet as gone even if the balance is not. The advisory's instruction is to create a new wallet on a separate device, move everything to it, keep the new seed phrase offline and reset the old machine. Removing the malware does not undo what it already copied.