North Korean Hackers Targets Job Seekers with Fake FreeConference App

North Korean hackers are using a fake FreeConference App to target job seekers. The actors are using a Windows video conferencing application to impersonate FreeConference.com. This is allowing them to backdoor developer systems. The financially-driven campaign is called “Contagious Interview,” and CrowdStrike is tracking the North Korean threat group under the name “Famous Chollima.” The attacks first start with a fake job interview which tricks victims into downloading and running a Node.js project. The project contains malware which delivers a backdoor giving the attackers keylogging, remote control, and browser stealing capabilities.