North Korean attackers pose as recruiters for financial firms to lure developers into executing trojanized Python projects on their machines as part of fake job interviews.

A DPRK-linked group is using fake job sites and Python malware to infiltrate Windows systems of blockchain professionals — with credential theft and remote access as the endgame.