A subgroup of the North Korea-linked hacker organization Lazarus set up three shell companies, two in the United States, to deliver malware to unsuspecting users.

The three sham crypto consulting firms — BlockNovas, Angeloper Agency and SoftGlide — are being used by the North Korean hacker group Contagious Interview to distribute malware through fake job interviews, Silent Push threat analysts said in an April 24 report.

Silent Push senior threat analyst Zach Edwards said in an April 24 statement to X that two shell companies are registered as legitimate businesses in the US.

“These websites and a huge network of accounts on hiring / recruiting websites are being used to trick people into applying for jobs,” he said.

“During the job application process an error message is displayed as someone tries to record an introduction video. The solution is an easy click fix copy and paste trick, which leads to malware if the unsuspecting developer completes the process.”

Three strains of malware — BeaverTail, InvisibleFerret and Otter Cookie — are being used according to Silent Push.

BeaverTail is malware primarily designed for information theft and to load further stages of malware. OtterCookie and InvisibleFerret mainly target sensitive information, including crypto wallet keys and clipboard data.

Silent Push analysts said in the report that hackers use GitHub job listing's and freelancer websites to look for victims, among others.

AI used to create fake employees 

The ruse also involves the hackers using AI-generated images to create profiles of employees for the three front crypto companies and stealing images of real people.

“There are numerous fake employees and stolen images from real people being used across this network. We’ve documented some of the obvious fakes and stolen images, but it’s very important to appreciate that the impersonation efforts from this campaign are different,” Edwards said.

“In one of the examples, the threat actors took a real photo from a real person, and then appeared to have run it through an AI image modifier tool to create a subtly different version of that same image.”

This malware campaign has been ongoing since 2024. Edwards says there are known public victims.