Contagious Interview Campaign Compromises 30,000 Devices, Steals Over $10.7 Million in Cryptocurrency

According to a new joint cybersecurity advisory, North Korean threat actors operating under the "Contagious Interview" campaign have compromised at least 30,000 devices located in more than 100 countries. The operation has resulted in the theft of funds or account credentials from over 7,000 cryptocurrency wallets, with total stolen value exceeding $10.71 million.

The primary targets of the campaign are individual web designers, engineers, and specialists in cryptocurrency. The advisory does not detail specific exploitation techniques but indicates the campaign likely involves social engineering and remote access trojans designed to infiltrate the systems of design and crypto professionals. The campaign has been active, with the advisory published on September 21, 2026.

The scale of the compromise—30,000 devices across 100+ countries—and the financial impact of over $10.71 million stolen highlight the growing threat posed by state-aligned actors targeting the cryptocurrency sector and creative professionals.