Crypto developers face fake job offers that deliver malware and steal wallet data. A joint security alert links these attacks to North Korea’s WaterPlum group. Authorities urge stronger checks on recruiters, coding tests, and software used during online job interviews.
The September 18 advisory reports at least 30,000 infected devices across more than 100 countries. Attackers stole funds or login details from more than 7,000 wallets. Web3 developers and blockchain specialists were among the main targets from December 2025 through July 2026. Investigators valued the stolen crypto at 1.7 billion yen, or about $10.71 million.
1. Verify the Recruiter Through a Separate Channel
The FBI recommends checking a recruiter’s identity through a separate communication channel. Profile photos and career knowledge are insufficient proof of identity. The bureau also flags job offers with unrealistically high pay.
Attackers research public profiles and tailor offers to a target’s skills. Some use stolen photos or fake websites. Others build trust before requesting software downloads.
2. Question Requests to Fix Interview Software
A supposed video problem is a documented warning sign. The FBI flags requests to run scripts that allegedly restore interview calls. It also warns about custom applications used for tasks that standard software already handles.
Errors inside an assignment also deserve scrutiny. Blackpoint Cyber found a malicious chess project that deliberately failed during startup. Its error handler fetched and executed code from a remote service, leading to an OtterCookie infection.
That case shows why an error message needs review before further commands are run. Blackpoint found that the resulting malware gathered system details and screenshots. It also created a Windows startup entry to maintain access.
3. Keep Coding Tests Away From Work Devices
Crypto developers need to separate interview assignments from machines used for company work. FBI guidance recommends a virtual machine on a device outside the company network when a test requires code execution. This keeps the assignment away from normal workplace access.
A virtual environment still requires careful handling. NTT researchers found virtual environment checks in an OtterCookie version observed in April 2025. They assessed that these helped attackers distinguish sandbox activity from actual infections.
For crypto developers, sandboxing and restricted mode serve different purposes. A sandbox isolates the test environment. Restricted mode controls features within the code editor, as Microsoft’s guidance explains.
4. Keep Unfamiliar VS Code Projects in Restricted Mode
Microsoft says Restricted mode limits tasks, debugging, terminals, settings, and extensions. Basic code browsing and editing remain available. Developers therefore retain access to source files while several execution features stay restricted.
Folder location also matters. Trust assigned to a parent folder applies to its subfolders. Placing an unfamiliar project there gives it inherited trust, so the trusted-folder list needs attention.
This protection has limits. Microsoft warns that a malicious extension is still able to ignore Restricted mode. Its guidance recommends installing extensions only from trusted publishers.
The Workspace Trust editor allows developers to remove trusted folders. Microsoft also warns against overriding an extension’s trust restrictions without review. Extensions without declared support for Workspace Trust are disabled by default.
5. Review Packages and Tasks Before Execution
Unsafe NPM packages and VS Code projects appear in documented attacks on developers. NTT’s StoatWaffle research describes a blockchain-themed repository with a malicious tasks.json file. Opening and trusting that project activated a task that downloaded further code.
In an October 2025 report, Cisco Talos traced an infection to node-nvm-ssh on the official NPM repository. Its malware included code for recording keystrokes and taking screenshots. The reported package formed part of a modified application called Chessfi.
NPM documentation says the ignore-scripts setting blocks scripts defined in package.json files during installation. The option defaults to false. Installing one package also pulls in the dependencies it requires.
Commands such as npm start and npm test still execute their requested scripts when the setting is enabled. Their automatic pre- and post-scripts remain blocked.
6. Keep Wallet Secrets Off Interview Machines
The FBI advises against storing wallet passwords, private keys, and seed phrases on internet-connected devices. For crypto developers, this guidance directly concerns the data exposed during an infection.
NTT’s OtterCookie analysis found modules targeting Chrome passwords and files linked to MetaMask. The malware also collected clipboard contents and cryptocurrency-related files. These targets extend beyond the code supplied for a hiring test.
StoatWaffle presents similar risks. NTT found that it stole browser credentials and selected extension data. On macOS, its collection included the Keychain database, which holds sensitive login information.
7. Act Quickly After Suspected Malware Exposure
The joint advisory urges victims of suspected fake-job malware incidents to disconnect affected devices from the internet immediately. It warns that removing malware leaves the possibility that wallet data has already been stolen.
The FBI’s response guidance asks victims to preserve messages, usernames, and other evidence. It recommends leaving disconnected devices powered on to preserve recoverable malware traces. The agency also advises discussing forensic examination with investigators.
Authorities advise creating a new wallet on a separate device and transferring assets to it. The replacement seed phrase should stay offline. The joint advisory also recommends backing up essential data and fully resetting the affected operating system.
Related: Fake AI Crypto Tools Replace Wallet Extensions—How to Spot the Trap
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
