North Korean Hiring Fraud Runs on AI and US Laptop Farms
2026-06-17T20:52:18Z•a850a22f9d136a0146a15a0fd1baf0cb4a603c356a165d382ee6f71b8ecd9426
AI-assisted-attacksAnubisAsyncRATDragonForceGitHub-PagesRokarollaSheetBest-APISilabRATSprySOCKSVidaragentjackingcisa-patching-by-riskcredential-theftjetbrains-pluginslaw-enforcement-takedownmalwaremoney-laundering-seizurenpm-securityphishingransomwaresensitive-data-to-AIserverless-phishingvulnerability-managementwordpress-supply-chainzero-days
What happened
A wide array of active threats and systemic risks: attackers are leveraging AI (including AI-run interview scams and "agentjacking") and abusing cloud/hosting platforms (serverless GitBait on GitHub Pages, SheetBest API) to run large-scale phishing and credential theft campaigns. Multiple supply-chain and developer ecosystem compromises were reported (backdoored WordPress plugins affecting ~1.2M sites, malicious JetBrains IDE plugins stealing API keys, npm/security changes), while malware families (SprySOCKS, Rokarolla, SilabRAT, AsyncRAT, Vidar) and ransomware groups (DragonForce, Anubis) are
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- infosecurity_magazine
- Record identifier
- a850a22f9d136a0146a15a0fd1baf0cb4a603c356a165d382ee6f71b8ecd9426
- Enrichment time
- 2026-06-17T20:52:18Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.