A subgroup of the North Korea-linked hacker organization Lazarus has been identified setting up three shell companies in the US to distribute malware to unsuspecting users. The three sham crypto consulting firms, including BlockNovas, Angeloper Agency, and SoftGlide, are being utilized by the North Korean hacker group Contagious Interview to spread malware through fake job interviews, as per a report by Silent Push Threat Analysts on April 24. Silent Push’s senior threat analyst, Zach Edwards, mentioned that two shell companies are registered as legitimate businesses in the United States. The hackers use these websites and a vast network of accounts on hiring or recruiting platforms to deceive individuals into applying for jobs. Once the job application process is initiated, an error message prompts the applicant to click, copy, and paste a fix, leading to malware installation if the developer completes the process. The malware strains being used include BeaverTail, InvisibleFerret, and Otter Cookie. BeaverTail primarily focuses on information theft and loading more malware stages, while OtterCookie and InvisibleFerret target sensitive information such as crypto wallet keys and clipboard data. Silent Push analysts revealed that hackers utilize GitHub, job listings, and freelancer websites to target victims. The fraudulent activity also involves using AI-generated images to create fake employee profiles for the shell companies. Despite the FBI shutting down one of the companies involved, the campaign has been ongoing since 2024, with known public victims and developers being targeted. The Lazarus Group, including North Korean hackers, are suspected in major cyber thefts in Web3, such as the Bybit $1.4 billion hack and the $600 million Ronin network hack.