Digital Parasites
2026-02-12 • Rekt •
Rekt describes DPRK fake IT-worker and recruiter operations that weaponize both sides of the employment pipeline against Western companies, crypto firms, and job seekers. In the insider-worker scheme, North Korean operatives use stolen identities, fabricated work histories, and polished social profiles to obtain remote developer roles, then access codebases, copy repositories to personal cloud accounts, harvest credentials, map infrastructure, and in some cases use stolen code for ransom. The excerpt also links the Contagious Interview campaign to fake recruiter personas that lure candidates into cloning GitHub repositories and running technical assessments containing BeaverTail or InvisibleFerret. A related fake Zoom or Teams lure uses hijacked trusted accounts, Calendly scheduling, simulated meeting issues, and malicious patches to compromise targets, with Taylor Monahan cited as saying this method has stolen more than $300 million. The DPRK-relevant sections matter because they show social engineering, employment access, and credential theft functioning as primary intrusion paths for cryptocurrency theft rather than reliance on software exploits.