Fake Crypto Job Interview Scam: Don't Run That File

What is the fake crypto job interview scam?

It's malware delivery dressed up as hiring. The company has a website, the recruiter has a LinkedIn history, and there may be several rounds of calls. Then comes one small technical step: install our meeting app, run this repo, or paste this line because your microphone isn't working. Do it once and the attackers are on your machine.

Developers get hit hardest, but marketing and community jobs are used as lures too, because the people applying often hold crypto and keep wallets in their browser.

The scale is now on the record. On September 18, 2026, Japan's National Police Agency, the FBI and agencies from Australia and Germany published a joint advisory on a North Korean group called WaterPlum, commonly referred to as "Contagious Interview." It says that from around December 2025 through July 2026 the group exploited at least 30,000 computers in more than 100 countries and took funds or account credentials from over 7,000 crypto wallets, moving at least 1.7 billion yen (about $10.71 million) in crypto to North Korea.

A single case can cost more than that. Singapore's police and its Cyber Security Agency issued a joint advisory on August 14, 2026 about a fake recruiter on LinkedIn who used a lookalike email domain, several video interviews and a rigged coding test on a company laptop. The malware gave the attackers internal company credentials, and they used them to move about US$11.8 million (roughly S$15 million) in crypto.

Who is behind fake crypto job interviews?

More than one crew, which is why the details keep changing.

North Korea-linked groups. The FBI warned in a September 2024 public service announcement that North Korean actors were running "highly tailored, difficult-to-detect" social engineering campaigns against people in DeFi and crypto, often built around offers of new employment. It said they research targets on professional networking sites, speak fluent or nearly fluent English, and can spend a long time building rapport before the malware arrives. The 2026 advisory says WaterPlum often impersonates real AI, crypto and NFT companies. Microsoft's security team said in March 2026 that the Contagious Interview operation has been active since at least December 2022.

Ordinary criminal gangs. Not every fake interview leads to Pyongyang. In early 2025, BleepingComputer reported on a fake Web3 company, "ChainSeeker.io," that posted jobs on LinkedIn, WellFound and CryptoJobsList, then told applicants to install a meeting app called GrassCall. It installed password and wallet stealers on Windows and Macs, and victims reported drained wallets. Researchers tied it to a Russian-speaking group called Crazy Evil. Whoever is on the other end, the playbook and the defense are the same.

The three "interview" requests that install malware

1. "Download our video-call app." The recruiter sends a link to a polished download page for the company's "own" meeting software. That's the GrassCall pattern. The FBI lists "insistence on using non-standard or custom software to complete simple tasks easily achievable through the use of common applications," such as video calls, as a sign of North Korean social engineering.

2. "Clone this repo and run it." The developer version: a take-home test or a bug to fix, hosted on GitHub, GitLab or Bitbucket. The WaterPlum advisory says the group hides malware in Node.js (npm) packages, and one malware family uses blockchain-themed projects whose hidden Visual Studio Code settings run code the moment you open the folder and click "trust." You don't even have to press run.

3. "Your camera isn't working. Paste this to fix it." Security firm Sekoia named this "ClickFake Interview" in 2025. You're sent to a real-looking interview site to record answers. At the camera step, an error appears with a "how to fix" button that tells you to copy a command into your Terminal or PowerShell, often dressed up as a driver update. That line downloads the malware. This version catches non-developers, because the instructions are simple enough for anyone to follow.

Real recruiter vs fake recruiter: the red flags

Judge the request, not the profile. The FBI says these actors use pictures stolen from real people's social media, and the 2026 advisory says WaterPlum members have used AI face-swapping on video interviews, then turned the camera off, blaming network issues.

Safer job interview habits for crypto jobs

These work whether you write code or have never opened a terminal.

1. Verify the company yourself. Find the company's website yourself, not through the recruiter's link, and check the job is on its careers page. The FTC notes that real recruiters generally email from their company's domain, not a Gmail or Yahoo address. Lookalike domains exist, so read the address letter by letter. Our guide on how to check if a crypto project is legit has the wider checks.
2. Confirm the person on a second channel. The FBI suggests verifying a contact on a separate platform. If they found you on LinkedIn, ask for a live call from their company email, or call the company's main number and ask for them by name.
3. Install nothing. Say: "I'll join on the platform I already use, or in a browser." A real recruiter says fine. A fake one finds a reason it has to be their app.
4. Never paste commands for a camera or audio problem. If something breaks, offer to reschedule or switch to a phone call.
5. Developers: run nothing on your real machine. The FBI says to insist on a virtual machine or a device the tester provides. Open unknown projects in VS Code's Restricted Mode (answer "No" when it asks if you trust the author), and read any .vscode/tasks.json file first.
6. Keep your crypto off the job-hunting computer. The FBI advises against storing seed phrases, private keys or wallet logins on internet-connected devices. A hardware wallet for savings and a separate device for interviews takes most of the prize away. Our hot wallet vs cold wallet guide explains the split.

Got a recruiter message you're unsure about? Run it through our is this a scam? quiz, or browse every guide in the Scams hub.

Prefer to watch? The fake crypto job interview, in under a minute.

I ran the file from a fake interview: what to do first

Assume everything on that computer has been copied. The advisory says that even after malware is removed, your wallet data may already be gone. Work in this order.

1. Disconnect the computer from the internet. Unplug the cable and turn off Wi-Fi. Both the FBI and the advisory put this first. The FBI also suggests leaving the machine powered on if you plan to report, so evidence isn't lost.
2. Move your crypto from a different, clean device. Create a brand-new wallet with a new recovery phrase on another phone or computer, write the phrase on paper, and move everything to it, most valuable first. Don't type the old phrase anywhere.
3. Change passwords from the clean device. Email first, then exchanges, banking, password manager and work accounts. Log out of all sessions, because stolen browser cookies can keep attackers signed in. If you approved token spending from that browser wallet, check and revoke your token approvals too.
4. Wipe the computer. Back up only the documents you need, then fully reset the operating system. Undetected malware may stay behind, so an antivirus scan alone isn't enough.
5. Tell your employer if it was a work device or touched work accounts. In the Singapore case, the damage came through company credentials. Your security team needs to rotate keys and check access today, not next week.
6. Report it. Save screenshots of the job post, profiles, chats, domains and file names, plus any transaction IDs. File at ic3.gov and at ReportFraud.ftc.gov, and report the fake recruiter to the platform that hosted them.

Then watch for the second scam. People who post about being drained are often contacted by "recovery experts" asking for a fee. Our guide to crypto recovery scams shows how that one works.

Fake crypto job interview scam FAQ

Can a job interview really install malware on my computer?

Only if you download, run or paste something they send you. Joining a normal video call doesn't infect you. The danger is the extra step: a "meeting app," a coding test you run, or a command to fix your camera.

Is it a scam if a recruiter asks me to download an app for the interview?

Treat it as one. The FBI lists insistence on custom software for simple tasks like video calls as a warning sign. Offer to join on a platform you already use or in your browser, and walk away if they refuse.

Should I run a coding test from a GitHub repo?

Not on your everyday computer. The FBI says to use a virtual machine or a device the tester provides, and the 2026 advisory warns that some malicious projects run code as soon as you trust the folder in VS Code. Read the code first and open unknown projects in Restricted Mode.

What is Contagious Interview?

It's the common name for a North Korean hacking group's fake job interview campaign, which the FBI and Japan's National Police Agency call WaterPlum. The group poses as employers, often AI, crypto or NFT companies, and gets job seekers to run malware. Their September 2026 advisory says it infected at least 30,000 computers.

I ran the file. Is wiping my computer enough?

No. Assume your passwords, browser sessions and seed phrases were copied before you noticed. Move your crypto to a new wallet from a clean device and change passwords there first, then wipe the computer.

Where do I report a fake crypto job interview?

File a complaint with the FBI at ic3.gov and with the FTC at ReportFraud.ftc.gov. Report the recruiter's profile and the job post to the site where you found them. If a work device was involved, tell your employer's security team the same day.