30th October 2026
A seemingly genuine job offer, an invitation to attend an online interview and a request to complete a technical test might sound like an ordinary part of modern recruitment. But increasingly, cybercriminals are turning this familiar process into a way of breaking into computers, stealing information and gaining access to business networks.
The warning has become particularly relevant following the reported security incident at cryptocurrency exchange Binance, which has drawn attention to the vulnerability of computers used by employees with access to important business systems.
There are two developments worth examining. One concerns the reported Binance incident, while the other involves a North Korean-linked cyber operation that has been using fake recruitment opportunities to infect computers. Although they are not confirmed to be the same attack, both demonstrate how compromising an individual's computer can have consequences far beyond that person.
The Binance warning
On 30 October 2026, Binance disclosed a major security incident which it estimated could involve approximately $6.3 billion in affected assets.
The company's preliminary investigation indicated that an attacker may have gained access through a compromised laptop belonging to a DevOps engineer. This potentially allowed the attacker to reach a service container and submit unauthorised withdrawal transactions.
Binance said it had found no evidence that cryptocurrency wallet private keys had been leaked. It also reported that approximately $3 billion in affected assets had been frozen and said it would cover losses.
Blockchain intelligence company TRM Labs subsequently attributed the theft to North Korea's TraderTraitor hacking operation, although Binance said it was working with law enforcement to establish the identity of those responsible.
The important point for businesses is not simply the amount of cryptocurrency involved. It is the apparent route through an employee's computer into systems containing assets worth billions.
A company's security arrangements can be extremely sophisticated, but if criminals gain access through an employee's device, they may be able to bypass some of those protections.
The fake job interview operation
A separate operation attributed to North Korean-linked cybercriminals demonstrates how people can be persuaded to compromise their own computers.
The group, known as WaterPlum and also referred to as Contagious Interview, has been targeting software developers, IT specialists and people working in the cryptocurrency industry.
The approach is deceptively simple.
A criminal poses as a recruiter or representative of a technology company. The victim is offered an attractive employment opportunity and invited to take part in an online interview or technical assessment.
The prospective employer then asks the applicant to download a project, software package or coding test, often from a platform that appears legitimate.
Hidden within the downloaded material is malicious software. Once executed, it can give criminals access to the computer, allowing them to steal passwords, confidential information, cryptocurrency credentials and other sensitive data.
The international scale is considerable. A joint advisory issued in September 2026 by American, Japanese, Australian and German authorities reported that at least 30,000 devices had been compromised in more than 100 countries between December 2025 and July 2026.
The operation had also resulted in the theft of funds or account credentials from more than 7,000 cryptocurrency wallets. The authorities estimated that around 1.7 billion Japanese yen, equivalent to approximately $10.7 million, had been transferred in cryptocurrency to North Korea.
The campaign is particularly concerning because it exploits something people do every day: downloading a file because somebody they believe they can trust has asked them to do so.
It is not just cryptocurrency companies at risk
It would be a mistake to think this is only a problem for large cryptocurrency exchanges or technology businesses.
Almost every organisation now depends on computers, email systems, cloud storage and digital records. Even a relatively small business may hold valuable customer information, banking details, supplier records, passwords and commercially sensitive documents.
Consider what could happen if an employee downloaded an apparently harmless file from an unknown source.
The criminals might gain access to the employee's computer, but that could be only the beginning. If the computer is connected to the company's network, they may attempt to move further into the organisation.
They could potentially access shared files, obtain login credentials, monitor communications or use the compromised computer as a stepping stone towards other systems.
A small business might not even realise that its computer has been compromised until information has been stolen or a financial loss has occurred.
The same risks apply to public bodies, charities, professional practices and organisations working from home.
What should employees and employers do?[/b]
The first lesson is that people should be much more cautious about downloading files or installing software supplied by someone they have not independently verified.
A professional-looking email, a convincing LinkedIn profile or a familiar company logo is not proof that the person contacting you is genuine.
Some sensible precautions include:
Verify the sender. Check that the recruiter or organisation is genuine using independently obtained contact details.
Be cautious with attachments and downloads. Do not automatically open files or install programmes simply because somebody has requested it.
Keep work and personal computers separate. Use a personal device for job applications and recruitment assessments rather than a computer connected to an employer's network.
Do not run unfamiliar software or code. This is particularly important for developers asked to complete technical tests.
Restrict software installation. Employers should consider preventing ordinary users from installing unauthorised programmes.
Keep security software updated. Operating systems, applications and antivirus protection should receive regular updates.
Use multi-factor authentication. An additional verification step can make stolen passwords less useful to criminals.
Report suspicious activity immediately. Anyone who has downloaded something questionable should contact their IT department rather than hoping nothing has happened.
Businesses should also consider whether employees have more access to company information and systems than they actually need. Limiting permissions can reduce the damage if an individual account or computer is compromised.
For software developers, unfamiliar code should be examined in an isolated environment, such as a properly configured virtual machine or sandbox, rather than being run on a computer containing business credentials and sensitive information.
Working from home creates additional challenges
Remote working has brought considerable benefits, but it has also made protecting business systems more complicated.
Employees may be using home broadband, personal Wi-Fi equipment and laptops outside the direct supervision of an organisation's IT department.
Someone applying for another job might think nothing of using their work laptop to complete an online assessment during a lunch break. But doing so could expose their current employer to risks that have nothing to do with the job application itself.
Employers need clear policies explaining what company equipment can be used for and what employees should do when they receive unexpected requests to download software.
Cybersecurity training should not be treated as something that happens once when somebody joins a company. Threats change, and staff need regular reminders.
A new kind of vulnerability
For many years, discussions about computer security concentrated on firewalls, passwords, antivirus programmes and sophisticated technical defences.
These remain important, but criminals have increasingly recognised that it can sometimes be easier to deceive a person than defeat a computer security system.
A fake recruiter, a fraudulent supplier, a convincing invoice or an apparently genuine software update can all provide an opportunity to gain access.
The lesson from the Binance incident and the separate fake recruitment campaign is that the security of an entire organisation can depend on the decisions made by one individual.
It is not necessary for an employee to be careless or technically inexperienced. The deception can be carefully planned, professionally presented and directed at people who have every reason to believe the request is genuine.
Businesses should therefore make one principle clear to everyone using their computers: never download or install something simply because somebody has asked you to do so. Check first.
In the digital workplace, being helpful and trusting is not always enough. Sometimes the safest response to an unexpected request is to stop, question it and verify who is really on the other end of the message.
cyber actor group targeting IT professionals
US Department of Defense Cyber Crime Center Joint international cybersecurity advisory