Fake Job Work le Remote Interview Scam: North Korea Lazarus BeaverTail npm Repo Malware, Litlhahlobo tsa Lisebelisoa tse Fake, le Lockdown ea Boitsebiso¶

Ho elelloa bohareng ba lipuisano tse hole tsa mosebetsi kapa ts'ebetso ea ho ts'oara hore "mohiri" kapa "mookameli ea hiriloeng" o sebelisa sefi sa marang-rang kapa leraba la lichelete ke ts'ohanyetso e ka pele. Maqheka a kajeno a hole a arola likarolo tse peli tse senyang haholo tse khethiloeng ke FBI, CISA, le mekhatlo ea lefats'e ea cyber: (1) Software Developer le Crypto "Coding Assessment" Malware (Contagious Interview / Sehlopha sa DPRK Lazaro BeaverTail & InvisibleFerret), moo mohiri ho LinkedIn, Upwork, kapa Telegraph a kopa moenjiniere oa software kapa mokhethoa oa Web3/AI ho kopanya polokelo ea GitHub, GitLab, kapa Bitbucket le ho tsamaisa npm install && npm start (kapa mohaho oa Python / Docker) holim'a laptop ea bona ea mantlha ho "lokisa phoso pele ho puisano e phelang," ka khutso a bolaea motho ea utsoang lintlha ea hlahisang cookie e 'ngoe le e 'ngoe ea sebatli, polokelo ea mookameli oa password, .ssh senotlolo, .env faele, le sepache sa cryptocurrency ka tlase ho metsotsoana e 5; le (2) Cheke ea Fake "Thepa ea Ofisi ea Lehae" le Reshipping Mule Scams, moo k'hamphani e iqapetsoeng e etsang lipuisano tsa mongolo/Lihlopha, e romella lengolo-tsoibila la maiketsetso. $2,500 to $5,000 sheba "MacBook Pro le setupo sa ofisi ea lapeng," 'me e u laela hore u kenye cheke le ho romela $2,200 ka Zelle, Venmo, terata, kapa likarete tsa limpho ho "morekisi oa bona ea amohetsoeng oa lisebelisoa tsa IT" pele cheke e putlama matsatsi hamorao. Bakeng sa bosholu ba boitsebahatso ba SSN/I-9 le bosholu ba tlhahlobo e akaretsang, bona scam ea tlhahiso ea mesebetsi e seng ea nnete, bosholu ba ho hlahloba lisebelisoa, le bosholu ba boitsebiso ba onboarding; bakeng sa ho potoloha ha sephutheloana sa npm/PyPI le bosholu ba li-cookie tsa sebatli, buisana phepelo ea thepa npm/PyPI sephutheloana sa sephutheloana le ho potoloha ha linotlolo tsa mochini oa mosebetsi le ho koeteloa ha li-cookie, malware a infostealer, le ho hlakoloa ha password. Haeba u tobane le khatello ea 'mele hang-hang, ho sokeloa ka letsoho, kapa ho qothisana lehlokoa le motho ka mong, letsetsa nomoro ea hau ea tšohanyetso ea lehae (911 United States le Canada, 112 ho pholletsa le European Union, 999 United Kingdom) kapa sheba bukana ea rona ea dinomoro tsa tshohanyetso.

Etsa sena hona joale¶

1. HAEBA U MAHALA npm install, npm test, yarn, pip install, kapa Zoom/Teams/Miro ea bohata .dmg/.exe bakeng sa tlhahlobo ea mosebetsi: NKA K'homphieutha EA HAO HO WI-FI LE ETHERNET KA METSOTSO E 3:
2. Hula thapo ea Ethernet kapa u bulele Wi-Fi OFF hang-hang.
3. The BeaverTail JavaScript/Node.js e jarollotsoe tikoloho e nkehang ea Python (-/.npl kapa %UserProfile%\.pyp) mme e qala InvisibleFerret backdoor, e hokahanyang le taelo-le-taolo (C2) seva (:1224 / :1244) ho phallela likonopo tsa hau, clipboard, le tsamaiso ea lifaele ho phela.
4. ** Sebelisa smartphone e arohaneng, e hloekileng (iPhone kapa Android ho data ea cellular) ho tlosa li-wallet tsohle tsa cryptocurrency le ho hlakola karolo e 'ngoe le e 'ngoe e sebetsang ea sebatli (Google, GitHub, AWS, Microsoft, Apple)**:
5. BeaverTail lipakane MetaMask, Phantom, Rabby, Coinbase Wallet, Trust Wallet, Exodus, Electrum, le Solana CLI (-/.config/solana/id.json) lifaele tsa polokelo, hammoho le Login Data le Cookies ho tsoa ho Chrome, Brave, Edge, Arc, le Firefox, hammoho le macOS ea hau login.keychain-db.
6. Ho tsoa sesebelisoa se hloekileng, fetisetsa thepa efe kapa efe ea li-crypto ho li-wallet tse chesang ho peō e ncha ea sepache sa Hardware, hlakola linako tsohle tsa webo tse sebetsang ho Google (myaccount.google.com/security), GitHub (github.com/settings/sessions), le li-consoles tsa AWS/Cloud, 'me u hlakole linotlolo tsa hau tse senyehileng tsa SSH le GPG ho GitHub/GitLab.
7. HAEBA O BEHETSE CHEKEKO YA "SESEBETSI SA HOME OFFICE" HO TSWA HO MOHIRI: O SE KE WA ROMA DOLA E LE FEELA HO "MOREKI" MANG LE MANG, MME O LETSE LEKALA LA BOTSOALLE LA BANK YA HAO HANG-HANG:
8. Le ha sesebelisoa sa hau sa banka se bontša $3,500 hlahloba e le "Available Balance / Funds Released," hore chelete e ** HASE ** e hlakotsoe. Tlas'a US Federal Reserve Regulation CC (Expedited Funds Availability Act), libanka li tlameha ho etsa hore li-check deposit li fumanehe ka nakoana 1 to 2 business days, athe ho fumana hore nomoro ea cheke ea cheke/ak'haonte e entsoe ho nka 5 to 14 business days.
9. Letsetsa nomorong e ka morao ea karete ea hau ea banka 'me u tlalehe: *"Ke ne ke hlasetsoe ke bolotsana ba cheke ea mosebetsi 'me ke sa tsebe ka kenya cheke eo ho belaelloang hore ke ea bohata; ke kopa o tšoaee deposit hore akhaonto ea ka e se koaloe bakeng sa bomenemene."
10. HAEBA U SE U ROMETSE ZELLE, VENMO, WIRE, KAPA BITCOIN ATM CHELETE HO "EQUIPMENT VENDOR": Letsetsa desk ea banka ea hau ea Fraud / Wire Recall hang-hang (bakeng sa lithapo, kopa hang hang **SWIFT / Fedwire Recall le FBI IC3 Recovery Asset Team hoama **; bakeng sa Litefiso tsa Zelle/Faster, tlaleha Tefo e lumelitsoeng ka Push (APP) bolotsana ba boikaketsi ba mosebetsi tlasa tumello ea push payment app qhekella le litokelo tsa puseletso).
11. HAEBA U TLAITSILE SSN, PASPORT, LAesense YA MOQEBI, W-4, I-9, KAPA NOMORO YA TSELA EO DEPOSIT BANK ROUTING NUMBER: Beha mokoloto ho Equifax, Experian, le TransUnion, emisa ChexSystems, notlela-SSNify ea hau ho mymyeverify.uscis.gov), 'me u kope banka ea hau hore e koale nomoro ea ak'haonte e pepesitsoeng ebe e bula nomoro ea ak'haonte e ncha.
12. HAEBA U AMOHILE MOSEBETSI OA "TEKAHLOLO EA PACKAGE / LOGISTICS LOGISTICS" MOSEBETSI OA HO AMOHELA LE HO FETOLA LIPHAPELE HOTLOA LAPENG: KHAOTSA HO ROMELA LIPAKE HAHANG: Lisebelisoa tseo tsa elektroniki (iPhones, MacBooks, camera lenses) li ile tsa rekoa ka likarete tsa mokitlane tse utsoitsoeng 'me tsa romelloa atereseng ea lapeng (Parcel Mule Scam). Boloka mangolo ohle a thomello le lingoloa tsa meqoqo 'me u ikopanye le mapolesa a lehae kapa ** Ts'ebeletso ea Tlhahlobo ea poso ea US (USPIS)**.

Sefate sa liqeto: lipuisano tse hole le tlhahlobo ea tšohanyetso ea mosebetsi oa bohata¶

Sebelisa chate ena ho tlolela ka kotloloho ho protocol ea sephutheloana e tsamaellanang le mofuta oa bosholu oo u kopaneng le ona:

flowchart TD
    Start["Boemo ba Tšohanyetso: Puisano eo ho belaelloang hore ke ea Fake ka Mosebetsi, Teko ea Coding, kapa Onboarding Scam"] --> ScamType{"'Mohiri' kapa 'Mohiri' o U Kopile Hore U Etse'ng?"}

    ScamType -->|"1. Kopanya Git Repo & Run npm / Python / Docker KAPA Kenya Sesebelisoa sa Mehala ea Video"| DevTrap["TLHOKOMELISO: Puisano e tšoaetsanoang ea DPRK (BeaverTail / InvisibleFerret) Info-Stealer"]

    ScamType -->|"2. Beha Cheke (PDF/Mail) & Romela Chelete ho 'Morekisi ea Amoheletsoeng oa Thepa'"| CheckTrap["Scam ea Tefo e Felletseng ea Cheke: Cheke e Nang le Mokoloto e Tla Tlama ka Matsatsi a 5-14"]

    ScamType -->|"3. E Tlatsitse Foromo ea I-9 / W-4 / SSN / Passport / Direct Deposit Pele o Fumana Scam"| IdTrap["Identing Identing & Payroll Theft: Freeze Credit, ChexSystems, IRS IP PIN, & Bank Account"]

    ScamType -->|"4. Amohela Liphutheloana Lapeng, U li hlahlobe, 'me u li romele hape ka Li-Labels tse Fanoeng KAPA Lefa 'Task' Crypto."| MuleOrTask["Reshipping Parcel Mule KAPA 'Tlhahiso ea App' Crypto Task Scam"]

    DevTrap --> CutNet["1. Koala Wi-Fi / Unplug Ethernet Hang-hang ho Developer Workstation"]
    CutNet --> EvacPhone["2. Mohalang o Hloekileng: Tsamaisa Matlotlo a Crypto + Hlakola Session ea Google/GitHub/AWS + Fetola Linotlolo tsa SSH"]
    EvacPhone -->ForensicClean["3. Hlahloba -/.npl, -/.pyp, package.json, & Browser Profiles -> Hlakola & Reinstall OS hape ka Bohloeki."]

    CheckTrap --> SentMoney{"Na u se u rometse Chelete ho 'Morekisi oa Thepa'?"}
    SentMoney -->|"Che: Sheba e behiloe, $0 e rometsoe"| WarnBank["U SE KE UA Ama Lichelete -> Letsetsa Lefapha la Bosholu ba Banka Hang-hang ho Tlaleha Deposit ea Cheke e sa Tsebeng"]
    SentMoney -->|"E: E rometsoe ka likarete tsa Zelle / Wire / Crypto / Gift"| RecallFunds["Letsetsa Banka Wire/Fraud Desk Hang-hang -> Koahela Chelete e Fetang Kantle e Fosahetseng Pele U Hlahloba Litlhaselo -> Tlaleho ea Faele ea IC3"]

    IdTrap --> LockCredit["Freeze Equifax/Experian/TransUnion + ChexSystems -> Koala Nomoro ea Ak'haonte ea Banka e pepesitsoeng -> Notlela myE-Verify"]
    MuleOrTask --> StopShip["Emisa liphutheloana tsa ho romelloa hape 'me u emise ho beha Crypto -> Boloka li-Waybills & Tlaleha ho USPIS / IC3"]

Mokhahlelo oa 1: Tsela eo maraba a mabeli a maholo a hole a sebetsang ka tlas'a sekoaelo¶

Bapisa mekhoa ea botekgeniki le matšoao a lifolakha tse khubelu tsa li-vector tse tharo tsa mantlha tsa khiro tse sebetsang lefatšeng ka bophara:

Mokhahlelo oa 2: Karabelo ea Tšohanyetso Bakeng sa Bahlahisi ba Software (Contagious Interview / BeaverTail / InvisibleFerret)¶

Haeba u moqapi oa software ea entseng pokello ea polokelo ho tsoa ho mohiri kapa moqoqodi mme a matha npm install, npm start, yarn, pnpm, python, cargo, kapa e ka phethahatsoang setsing sa hau sa mosebetsi sa Windows, macOS, kapa Linux, latela tatellano ena ea karabelo ea liketsahalo e thehiloeng ho Palo Alto Networks Unit 42, CrowdStrike, le CISA/FBI bohlale bo sokelang Korea Leboea Contagious Interview lets'olo.

Mohato oa 1: Utloisisa Mothati oa 2 BeaverTail -> InvisibleFerret Kill Chain ho disk ea hau¶

Sebaka se bonahalang se tloaelehile sa React/Node.js se tšoaelitse Mac kapa PC ea hau joang ntle le ho hlahisa popup ea antivirus?

+-------------------------------------------------------------------------+
| ANATOMY OF A CONTAGIOUS INTERVIEW (BEAVERTAIL) MALICIOUS REPO           |
|                                                                         |
| 1. The Decoy Repo (e.g., "mern-ecommerce-assessment" or "defi-dex-ui"): |
|    - 99% of the repo is real, working React/Express boilerplate code.   |
|    - Hidden at the very end of `server/routes/api/auth.js` or           |
|      `backend/controllers/userController.js` (often scrolled 300 spaces |
|      to the right on one line so you do not see it in VS Code) is an    |
|      obfuscated `eval(Buffer.from(...))` or `axios.get(...)` call.      |
|                                                                         |
| 2. Stage 1: BeaverTail (JavaScript Info-Stealer inside Node.js):        |
|    - Scans Chrome, Brave, Opera, Edge, Vivaldi (`Default` & `Profile N`)|
|      for `Login Data`, `Local Extension Settings` (MetaMask `nkbihfbeog`|
|      Phantom `bfnaelmome`, Rabby `acmacodkjb`), and Solana `id.json`.   |
|    - Uploads stolen vaults & cookies immediately to `http://<C2>:1224`. |
|                                                                         |
| 3. Stage 2: InvisibleFerret (Python Backdoor + AnyDesk Persistence):    |
|    - BeaverTail downloads a standalone portable Python 3.11 zip into    |
|      `~/.npl/` or `%UserProfile%\.pyp\` and runs `~/.npl/.pyp/python`   |
|      executing `~/.npl/main.py` (`InvisibleFerret`).                    |
|    - InvisibleFerret logs keystrokes, reads your clipboard, scans your  |
|      entire drive for `.env`, `.ssh`, `seed`, `mnemonic`, and silently  |
|      downloads/configures `AnyDesk` for full remote desktop control.    |
+-------------------------------------------------------------------------+

Mohato oa 2: Lekola hore na e nepahetse BeaverTail le InvisibleFerret Lipontšo tsa ho Sekisetsa (IoCs)¶

Ha komporo ea hau e tšoaelitsoeng ea Mac, Linux, kapa Windows e hokeloa ka botlalo ho Wi-Fi le Ethernet, bula terminal (kapa PowerShell) ho sheba hore na Mothati oa 2 (InvisibleFerret) e ile ea kenngoa ho disk ea hau:

# On macOS or Linux (WITH WI-FI OFF):
ls -la ~/.npl ~/.pyp ~/.vscode
ps aux | grep -iE "npl|pyp|main\.py|anydesk|node"

# Search the cloned interview repository for hidden horizontal-scroll obfuscation or base64 evals:
grep -rnE "Buffer\.from|child_process|execSync|\.npl|\.pyp|:1224|:1244|nkbihfbeogaeaoehlefnkodbefgpgknn" /path/to/cloned/interview_repo/

# On Windows PowerShell (WITH WI-FI / ETHERNET OFF):
Get-ChildItem -Path $env:USERPROFILE -Force | Where-Object { $_.Name -match "^\.(npl|pyp)" }
Get-Process | Where-Object { $_.Path -match "npl|pyp|AnyDesk" }

Mohato oa 3: Phetha Sengoloa sa Moetsi oa Metsotso e 15 le Phallo ea Crypto (Ho Tsoa Sesebediswa se Hloekileng)¶

Se ke oa** ho ngola li-password tse ncha kapa mantsoe a peo khomphuteng e nang le tšoaetso. Ho sebelisa ** smartphone e hloekileng (iPhone / Android) kapa komporo e arohaneng e sa sekisetseng**:

1. ** Tlosa li-wallet tsohle tsa Cryptocurrency Hot hang-hang (Minutes 0 to 5)**:
2. Leha sepache sa hau sa MetaMask, Phantom, Rabby, kapa Exoda se notletsoe ka senotlolo, BeaverTail e kentse faele ea hau e kentsoeng ea vault (000003.log / LOCK / Local Extension Settings) **le ** InvisibleFerret e tsamaisa sebali sa keylogger / clipboard ('me ho macOS ho hlaha letsoalloa la bohata osascript dialog ea phasewete e kopang password ea hau ea Mac System ho notlolla login.keychain-db).
3. Theha sepache se secha ho smartphone kapa sepache sa hardware (Ledger / Trezor) se nang le poleloana e ncha e ncha ea mantsoe a 12/24 ** 'me u fetisetse liperesente tse 100 tsa li-tokens tsa hau, li-NFT, le maemo a holimo ho sepache se seng le se seng se kileng sa ama komporo eo.
4. ** Hlakola GitHub, GitLab, Bitbucket, le Cloud kaofela (AWS / GCP / Azure / Vercel) lintlha (Minutes 5 to 10)**:
5. GitHub: Kena ka fono ea hau -> ** Litlhophiso -> SSH le linotlolo tsa GPG ** -> ** Hlakola ** senotlolo se seng le se seng sa SSH se bolokiloeng ho -/.ssh/ ho laptop ea nang le tšoaetso. Ebe u ea ho ** Litlhophiso -> Litlhophiso tsa Moetsi -> Li-tokens tsa phihlello ea hau ** (hlakola li-tokens tsohle) le ** Litlhophiso -> Litlhophiso ** -> ** Hlakola linako tsohle **.
6. ** AWS / GCP / Cloud **: hang-hang tima e 'ngoe le e 'ngoe AWS_ACCESS_KEY_ID bolokoa ka -/.aws/credentials kapa ka hare ho efe kapa efe .env faele ho laptop (InvisibleFerret recursively crawls mong le e mong foldara ea morero ho drive ya hao bakeng sa .env, .npmrc, .pypirc, kubeconfig, le id_rsa).
7. Haeba u ne u e-na le lipolokelo/linotlolo tsa Mohiri kapa Moreki laptop eo: Tsebisa Setsi sa Ts'ebetso ea Mohiri oa hau (SOC / CISO) hang-hang e le hore ba khone ho potoloha khoebo .env liphiri le boitlamo ba ho hlahloba.
8. Hlakola linako tsohle tsa sebatli (Google, Microsoft, Apple, Slack, Discord, Telegram) (Minutes 10 to 15):
9. Hopola: ho fetola phasewete hangata ha ho ho etsa hore li-cookies tse utsoitsoeng li se ke tsa sebetsa ntle le haeba u tobetsa ka ho hlaka "Tsoa ho lisebelisoa tsohle / Hlakola linako tsohle" ho Google Security, Microsoft Account, Slack, Discord, le X/Twitter.
10. Fetola molaoli oa hau oa Password (1Password, Bitwarden, Keeper) phasewete e kholo 'me u hlakole tokene ea sesebelisoa se lumelletsoeng sa laptop.
11. Hlakola le ho kenya hape Sisteme ea Ts'ebetso Setsing sa Ts'ebetso se tšoaelitsoeng: Hobane InvisibleFerret e kenya mesebetsi ea morao-rao e phehellang, e fetola li-binaries tsa sebatli, le marotholi AnyDesk ho fihlella hole, ho hlakola feela -/.npl 'me polokelo e entsoeng ka maiketsetso ha ea lekana. Boloka litokomane tse hlakileng feela / lifaele tsa mohloli (li netefalitsoeng li hloekile ka git status / git diff), ebe o hlakola OS e hloekileng ka botlalo ebe o kenya hape (macOS Erase All Content and Settings kapa karohano e hloekileng ea Windows USB).

Mokhahlelo oa 3: Karabelo ea Tšohanyetso bakeng sa "Lisebelisoa tsa Ofisi ea Lehae" tse Fake¶

Haeba u filoe mosebetsi o hole (Administrative Assistant, Data Entry, Customer Support, Project Coordinator, Graphic Designer), o ile a fumana cheke (ka imeile PDF ho hatisa le mobile-deposit, kapa ka FedEx/UPS bosiung bo bong enfelopo) ho reka laptop ea le thepa ea lapeng ofisi, le depositi ho akhaonteng ya hao ya banka, u peisong khahlanong le **Federal Reserve cheke cheke ho khutla fensetere **.

1. Hobaneng ha app ea banka e re "Chelete e Fumaneha" ka cheke ea 100% ea bohata (The Regulation CC Float Trap)¶

+-------------------------------------------------------------------------+
| HOW THE FAKE "EQUIPMENT CHECK" FLOAT TRAP WORKS                         |
|                                                                         |
| Day 1 (Monday): You deposit the scammer's $3,500 "Equipment Check"      |
|                 using your bank's Mobile Deposit app.                   |
| Day 2 (Tuesday): Under US Federal Law (Regulation CC), your bank MUST   |
|                  release the funds within 1-2 business days. Your app   |
|                  now shows: "Available Balance: +$3,500.00".            |
| Day 2 (Tuesday PM): "Hiring Manager" tells you to Zelle/Wire $2,800     |
|                     immediately to their "Approved MacBook Vendor" so   |
|                     your laptop arrives by Friday.                      |
| Day 8 (Next Tuesday): The real corporate bank whose routing/account     |
|                       number was forged on the check rejects it as      |
|                       COUNTERFEIT / ALTERED (`Return Code R29 / Refer   |
|                       to Maker`).                                       |
| RESULT ON DAY 8:                                                        |
|   - Your bank claws back the full $3,500.00 from your balance.          |
|   - The $2,800 you sent via Zelle/Wire is gone forever.                 |
|   - Your account drops to -$2,800.00 overdraft, and your bank's risk    |
|     algorithm may freeze/close your account and report you to           |
|     ChexSystems as a check-fraud risk.                                  |
+-------------------------------------------------------------------------+

2. Mohato ka mohato Protocol ea tšireletso ea banka haeba u kentse cheke¶

Taba ea A: U kentse cheke, empa HA U-SO romele chelete ho "morekisi" leha ho le joalo¶

O lahlehetswe $0 ho fihlela joale, 'me u ka thibela banka ea hau ho koala ak'haonte ea hau haeba u nka khato hona joale: 1. O SE KA oa ntša, oa sebelisa, kapa oa fetisetsa sente e le 'ngoe ea lichelete tsa cheke tse behiloeng. Tlohela ka botlalo $3,500 e lutse e sa ameha ka akhaonteng e le hore ha cheke e putlama ka matsatsi a 5 ho isa ho a 10, banka e khutlisa mokoloto oa eona oa nakoana ka mokhoa o hloekileng le $0 overdraft. 2. ** Letsetsa Lefapha la Bomenemene la banka ea hau hang-hang (kapa u kene lekaleng la sebele 'me u bue le Mookameli oa Lekala)**: - Ha cheke ea maiketsetso e thula ka khutso ntle le tlhaloso, lienjineri tsa kotsi tsa banka (Early Warning Services / ChexSystems) ha ke tsebe hore na u ne u le moqhekelli kapa motho ea se nang molato ea batlang mosebetsi. - Bolella moemeli oa banka ka ho hlaka: "Ke ile ka etsa kopo ea mosebetsi o hole 'me senokoane se nthometse cheke ea thepa ea '$3,500' eo ke e behileng ka mohala kajeno. Ke sa tsoa hlokomela hore ke bolotsana ba ho hlahloba mosebetsi oa bohata. HA KEA sebelisa kapa ho fetisetsa dollar e le 'ngoe ea lichelete. Ka kopo, beha molaetsa oa Mohlaseluoa oa Khiro profaeleng ea ka 'me u khutlisetse morao/tšoara cheke e se kotlo ea nakoana - Kopa banka hore e tlosoe $15 to $35 Tefiso e khutlisitsoeng ea Ntho e Behiloeng 'me u netefatse hore ak'haonte ea hau e ke ke ea tšoauoa hore e koeloe.

Nyeoe B: U kentse cheke LE hore u se u rometse chelete (Zelle, Venmo, Wire, Cash App, Crypto, kapa Gift Cards)¶

1. Leletsa Lefapha la Bomenemene la banka ea hau nakong ea metsotsoana e 60:
2. Tlaleha mahlakore ka bobeli a botlokotsebe: (a) Cheke depositi e tlang ke cheke ea bolotsana ea mosebetsi e tlang ho putlama, 'me (b) phetisetso e tsoelang pele ea Zelle / Venmo / Wire / ACH e bakiloe ke bomenemene mosebetsing.
3. Haeba u rometse Banka Wire (Fedwire / SWIFT) nakong ea lihora tse 24 ho isa ho tse 72 tse fetileng: Batla hang hang Fraudulent Wire Recall (SWIFT MT192 / pacs.004) mme o fane ka tlaleho e potlakileng ho ic3.gov kahoo FBI's Sehlopha sa Recovery Asset (RAT) e ka fana ka Ketane ea Kill ea Boqhekelli ba Lichelete (FFKC) ho hoama akhaonteng e amohelang mulete.
4. Haeba u rometse Zelle, Venmo, kapa UK Faster Payments: Faela Tefo e Dumeltsweng ya Push (APP) tseko ea bomenemene le ho kopa lintlha tsa banka e amohelang tsela/setheo (Zelle Network Fraud).
5. Haeba senokoane se u boleletse hore u reke likarete tsa Apple, Razer Gold, Steam, kapa Target Gift Cards: Letsetsa mohala oa bomenemene oa mofani oa karete ea limpho hang-hang ka linomoro tsa serial tsa risiti ho koala chelete e setseng ea karete e sa rekoang.
6. **Itokisetse bakeng sa $3,500 hlahloba clawback hore ak'haonte ea hau e se ke ea senyeha ho ChexSystems tefiso **:
7. Ha fake $3,500 hlahloba li-bounces ka matsatsi a 5 ho isa ho a 10, banka ea hau e tla hula $3,500 ho tsoa akhaonteng ea hau. Sebetsa le sehlopha sa banka ea hau ea ho khutlisa bomenemene ho theha moralo oa ho khutlisa tsoala bakeng sa chelete leha e le efe e fosahetseng pele ho letsatsi la 30 e le hore banka e se ke ea tlaleha ho koaloa ha akhaonto ka boithatelo ho ChexSystems kapa Litšebeletso tsa Temoso ea Pele (EWS).

Mokhahlelo oa 4: Ho notlela boitsebiso ba hau haeba u rometse lengolo la I-9, W-4, SSN, Passport, kapa foromo ea Direct Deposit¶

Bahiri ba bohata ba batla ba romella "Onboarding Packet" (Form W-4, Form I-9, Direct Deposit Authorization, le linepe tse ka pele le ka morao tsa License ea Mokhanni, Passport, kapa Karete ea Tšireletso ea Sechaba) pele u hlahisa cheke kapa leraba la malware. Haeba u rometse leha e le efe ea litokomane tseo, etsa lockdown ena ea mehato e 5 kajeno:

1. Koala nomoro ea ak'haonte ea banka e senotsoeng (Direct Deposit foromo): Foromo ea Direct Deposit e fa motho ea qhekellang Nomoro ea Ts'ebetso ea Banka (ABA) le Nomoro e felletseng ea Akhaonto ea ho Hlahloba, hammoho le kopi ea cheke e sa sebetseng le saena ea hau, e leng ntho e 'ngoe le e 'ngoe e hlokahalang ho hatisa licheke tsa pampiri ea bolotsana kapa ho qala ntle le tumello. ACH Debit e hula akhaonteng ya hao. Bolella banka ea hau hore **e koale nomoro ea ak'haonte eo 'me u ise chelete ea hau ho nomoro e ncha ea ak'haonte ea ka hare **.
2. Beha Mokitlane Freeze mahala ho liofisi tse tharo tsa mekitlane:
3. Equifax (equifax.com/personal/credit-report-services/credit-freeze/ / 1-888-298-0045)
4. Moitsebi (experian.com/freeze/ / 1-888-397-3742)
5. TransUnion (transunion.com/credit-freeze / 1-800-916-8800)
6. Ho hoama ChexSystems (chexsystems.com) le NCTUE: Libanka li sebelisa ChexSystems (eseng Equifax/Experian) ha motho e mong a bula akhaonto ea ho hlahloba ka lebitso la hau. Beha mahala ChexSystems Security Freeze marang-rang hore batho ba qhekellang ba se khone ho bula liakhaonto tsa banka tsa 'mule ba sebelisa laesense ea hau ea ho khanna e utsoitsoeng le pakete ea I-9.
7. ** Notlela Nomoro ea hau ea Tšireletso ea Sechaba ka hare myE-Verify (USCIS)**: Eya ho myeverify.uscis.gov ebe o kenya tshebetsong Self Lock, e thibelang mang kapa mang ho sebelisa SSN ea hau ho federal E-Verify Employment system.
8. Fumana IRS Identity Protection PIN (IP PIN) (irs.gov/ippin): Thibela batho ba qhekellang ho fana ka tlaleho ea puseletso ea lekhetho ka bomenemene ka lebitso la hau ka ho ingolisa ho PIN ea linomoro tse 6 IRS IP PIN hang-hang.

Mohato oa 5: Ho emisa "Parcel Reshipping Mule" kapa "Crypto Task" Scam ka mokhoa o sireletsehileng¶

Ho thoe'ng haeba u ne u hiretsoe e 'ngoe ea litsotsi tsena tse peli tseo u sa li hlahlobeng?

Boemo ba 1: U amohetse mosebetsi oa "Quality Control / Package Forwarding" 'me u na le liphutheloana ntlong ea hau.¶

Haeba u amohetse li-MacBook, li-iPhones, kapa lisebelisoa tsa elektroniki atereseng ea hau ea lapeng, 'me u fuoe li-labels tsa thomello tsa USPS/UPS/FedEx PDF hore u li romele: - **ETSA liphutheloana tsa thepa hang-hang **. Sephutheloana se seng le se seng se fihlang ntlong ea hau se rekiloe ho sebelisoa karete ea mokitlane e utsoitsoeng moo senokoane se kentseng lebitso la hau le aterese ea lapeng joalo ka Ship To aterese. - O SE KE UA khutlisetsa liphutheloana atereseng ea motho ea bolotsana: Boloka mabokose a sa buloang, boloka lengolo-tsoibila le leng le le leng, puisano ea Telegraph, lengolo la thomello ea PDF, le konteraka ea mosebetsi e le bopaki, 'me u ikopanye le mapolesa a lehae le U.S. Tšebeletso ea Tlhahlobo ea Poso (1-877-876-2455 / uspis.gov) (kapa Action Fraud UK) ho hlophisa ho khutlisetsoa ha thepa ho barekisi ba utsoelitsoeng.

Boemo ba 2: U hiriloe ka WhatsApp / Telegraph bakeng sa "Tlhaloso ea App Optimization / Product Rating" Crypto Task Job.¶

• Sefi se sebetsa joang: "Mohiri" oa u lefa $50 to $150 ka nnete USDT ka Letsatsi la 1 bakeng sa ho tobetsa likonopo sebakeng sa marang-rang sa fake. Ka Letsatsi la 2 kapa la 3, ak'haonte ea hau e tla fumana "Mosebetsi o Kopanetsoeng" o behang botsitso ba portal ea hau ho. -$400 'me e hloka hore u behe chelete $400 ea hau USDT ho "phethela sehlopha sa mesebetsi e 40." Nako eo u behang chelete ka eona $400, mosebetsi oa bobeli o batla $1,800, joale $6,000, joale $25,000 bakeng sa "makhetho."
• Khato ea Hanghang: ** KHAOTSA ho kenya chelete ea crypto hang-hang **. Linomoro tse sebakeng sa marang-rang sa mosebetsi ke litekanyetso tsa HTML tsa bohata tse laoloang ke scammer; Ho lefa chelete e fosahetseng ho ke ke ha bula chelete ea ho ntša chelete. Khaola mabitso ohle 'me u qobe "basomi ba ho hlaphoheloa ha crypto" ho Telegraph kapa Instagram.

Linomoro tsa libaka tsa tšohanyetso le liprothokholo tsa mekhatlo¶

Tlaleha malware a tlhahlobo ea hole (Contagious Interview), bomenemene mabapi le ho hlahloba mosebetsi, le bosholu ba boitsebiso ho balaoli ba molao ba marang-rang le ba lichelete sebakeng sa heno:

• United States le Canada: Letsetsa 911 bakeng sa tshohanyetso efe kapa efe ya polokeho ya mmele. Tlaleha moqapi oa malware (Lazarus / BeaverTail) le ho hlahloba mosebetsi oa bohata / tahlehelo ea mosebetsi ho FBI IC3 (ic3.gov), le FTC (ReportFraud.ftc.gov le IdentityTheft.gov), le USPIS (1-877-876-2455). Canada, ikopanye le Setsi sa Canada sa Khahlanong le Bomenemene (1-888-495-8501) le Setsi sa Canada sa Tšireletso ea Cyber ​​(1-833-CYBER-88).
• United Kingdom: Daela 999 bakeng sa maemo a tshohanyetso kapa 101 bakeng sa mapolesa a lehae. Daela 159 ho hokela lefapha la bomenemene la banka ya hao, le ho tlaleha bomenemene ba mesebetsi ya bohata le malware ho Action Fraud (0300 123 2040 / actionfraud.police.uk) le NCSC (ncsc.gov.uk). Nahana ka ** Ngoliso ea Tšireletso ea CIFAS (cifas.org.uk)**.
• European Union: Letsetsa 112 ho phatlalla le dinaha tsohle tseo e leng ditho tsa EU, tsebisa lefapha la bomenemene la banka ya hao hanghang, mme o fane ka tlaleho le lekala la naha la sepolesa sa cybercrime le CSIRT ya naha.
• Australia le New Zealand: Letsetsa 000 Australia kapa 111 New Zealand. Tlaleha bomenemene ba mosebetsi le mosebetsi ho Scamwatch (scamwatch.gov.au), ReportCyber (cyber.gov.au, 1300 CYBER1), mme o ikopanye le IDCARE (1800 595 160 ka AU / 0800 121 068 ka NZ).
• India le Asia-Pacific: Daela 112 naheng ea India bakeng sa maemo a tšohanyetso 'me u letsetse ** National Cyber Crime Helpline (1930 / cybercrime.gov.in)** hang-hang ho emisa phetisetso ea bomenemene ea banka. Naheng ea Singapore, letsetsa Mohala oa Thuso oa Anti-Scam (1799).

Lipotso tse botsoang khafetsa¶

Ke thehile polokelo ea GitHub ea mohiri (git clone ...), o ile a bula lifaele tsa VS Code ho li bala, 'me U SE KE UA matha npm install kapa npm start. Na ke ntse ke tšoaelitsoe?¶

Ho fapana le `npm install` (e mathang `package.json` scripts), e tsamaeang feela `git clone` le ho bala ka mokhoa o hlakileng `.js` lifaele ha li phethe khoutu ka botsona NTLE le ha polokelo e ne e e-na le kotsi e mpe `.vscode/tasks.json` faele ka `"runOn": "folderOpen"` 'Me u tobetse "E, ke tšepa bangoli" ha VS Code e bula foldara. Sheba hore na a `.vscode/tasks.json` faele e teng ka hare ho cloned repo (`cat /path/to/repo/.vscode/tasks.json`) le ho hlahloba haeba `-/.npl` kapa `-/.pyp` e entsoe bukeng ea hau ea lapeng. Haeba ha ho le teng 'me ha ho mohla u kileng ua matha `npm`, `yarn`, `python`, kapa `node`, sisteme ea hau ha ea ka ea etsa mosebetsi o lefelloang: hlakola feela foldara e hlophisitsoeng.

Ho thoe'ng haeba ke ne ke etsa tlhahlobo ea tlhahlobo ea likhoutu ka har'a setshelo sa Docker (docker compose up) ho Mac kapa Windows PC ea ka? Na setshelo se ile sa ntshireletsa?¶

Ho itšetlehile ka hore na ho kentsoe meqolo efe ka hare `docker-compose.yml` kapa ea `Dockerfile`. Haeba o ne o tsamaisa setshelo ka sistimi e ikhethileng, malware ha e khone ho bona li-cookie tsa hau tsa Chrome kapa katoloso ea MetaMask. Leha ho le joalo, tse ngata `Contagious Interview` polokelo kenyeletsa a `docker-compose.yml` e tlamang ka lekunutu buka ea hau ea lehae la moamoheli (`volumes: - -/.ssh:/root/.ssh` kapa `- -/:/host_home`) kapa e matha le `privileged: true`. Hlahloba `docker-compose.yml` ka repo hang-hang: haeba e ka nyoloha `-`, `$HOME`, kapa `/Users`, tšoara laptop ea hau ea moamoheli joalo ka ha e sekiselitsoe.

Cheke e ne e ka ba ea fake joang haeba e ne e le "Cheke ea Cashier" e fanoeng ke FedEx Overnight e nang le watermark mme morekisi oa banka a e amohela k'haontareng?¶

Licheke tsa motho ea etsang chelete ea maiketsetso li hatisitsoe ka har'a setoko sa 'nete sa tlhahlobo ea lik'hemik'hale ho sebelisoa nomoro e nepahetseng ea ho tsamaisa le matla a khoheli. `MICR` fonte ea enke ea banka e kholo. Motho ea fanang ka chelete ea banka fensetereng ea lekala o netefatsa feela hore nomoro ea ho tsamaisa e nepahetse le hore cheke e shebahala e le 'nete; morekisi ha a bone ka har'a buka ea ka hare ea banka ho tseba hore na nomoro eo ea cheke e hlile e fanoe. Ke feela ha setšoantšo sa cheke se tsamaea ka Federal Reserve clearinghouse (`5 to 10 business days later`) na banka e fanang ka eona e e hana ka hore ke ea maiketsetso.

A na nka ea teronkong haeba ke sa tsebe ke kentse cheke ea fake ea mosebetsi ’me ka sebelisa e ’ngoe ea chelete pele e qhoma?¶

Ho thetsoa ke bolotsana ba tlhahlobo ea mosebetsi ha ho na sepheo sa botlokotsebe (`mens rea`), ha feela o sa bue leshano ho banka mme o tlalehe bomenemene ho Lefapha la Bomenemene le mapolesa a banka (`IC3` / tlaleho ea sepolesa sa lehae) hanghang. Leha ho le joalo, tlas'a Tumellano ea Akhaonto ea Deposit ea banka ea hau le **Uniform Commercial Code (`UCC § 4-207 / § 4-214`)**, mong'a ak'haonte ea lumellang le ho kenya cheke o tlamehile ho lefa banka bakeng sa karolo ea 100 lekholong ea chelete leha e le efe e fosahetseng ea overdraft ha cheke e kentsoeng e khutla e sa lefuoa.

Hobaneng ha mohiri a ile a etsa mohala oa 'nete oa metsotso e 30 le 'na ho Zoom/Google Meet haeba e ne e le linokoane tsa Lazaro tsa North Korea?¶

DPRK **`Contagious Interview` (`UNC4899` / `Famous Chollima`)** basebetsi ba sebelisa batho ba buang Senyesemane hantle ho etsa mehala e kholisang ea HR ea metsotso e 20 ho isa ho e 45 ho Zoom, Google Meet, kapa Calendly. Hobane setsi sa mosebetsi se le seng se sebetsa hangata `$50,000 to $2,000,000+` ho linotlolo tsa protocol tsa DeFi, phihlello ea polokelo ea matlotlo a mangata, kapa mangolo a netefatso a tlhahiso ea leru, ho qeta metsotso e 30 o letsetse mohala oa video ho u kholisa ho matha. `npm install` tlhahlobong ea bona ea repo e na le phaello e phahameng ea matsete bakeng sa motšoantšisi oa tšokelo.

Ho thoe'ng haeba "mohiri" a romela chelete ka akhaonto ea ka ea banka ka ACH / Zelle 'me a nkōpa hore ke ntše chelete kapa ke reke Bitcoin hore ke e romele ho mofani oa bona?¶

Ke **Mule oa Chelete (`Layering`)** ts'ebetso. Ho fapana le cheke pampiri (e leng bounces pele ho rarolla), haeba `$4,000` ehlile e fihlile akhaonteng ea hau ka `ACH`, `Zelle`, kapa `Wire`, **tseo `$4,000` e utsoitsoe ak'haonteng ea banka ea motho ea se nang molato ea utsuoeng kapa ka bolotsana**. Haeba u e hula kapa u e fetolela ho "Bitcoin" bakeng sa "mohiri" oa hau, ts'ebetsong ea molao le banka ea motho ea hlokofalitsoeng e fumana chelete e utsoitsoeng ka kotloloho akhaonteng ea hau ea banka. O se ke wa hula kapa wa fetisa sente e le nngwe; letsetsa Lefapha la Bomenemene la banka ea hau hang-hang 'me u ba kope ho khutlisetsa phetisetso e sa lumelloeng setsing se qalileng.

Litataiso tse amanang¶

• scam ea tlhahiso ea mesebetsi e seng ea nnete, bosholu ba ho hlahloba lisebelisoa, le bosholu ba boitsebiso ba onboarding
• Supply chain npm/PyPI package comppromise and developer workstation key rotation
• Ho koeteloa ha li-cookie, malware a infostealer, le ho hlakoloa ha li-password
• Fake CAPTCHA ClickFix PowerShell Win+R clipboard malware le tokiso ea Lumma Infostealer
• Cryptocurrency sepache drain le peō poleloana sekisetsa
• Tefo e lumelitsoeng (APP) ea bomenemene ho app: Zelle, Venmo, le Litokelo tsa ho pusetsoa tse potlakileng
• Karabo ea bosholu ba boitsebiso
• Linomoro tsa maemo a tshohanyetso ho ea ka linaha

Mehloli le tataiso ea semmuso¶

• Federal Bureau of Investigation (FBI), Setsi sa Tšireletso ea Cybersecurity le Infrastructures (CISA), & Setsi sa DoD Cyber Crime (DC3) (United States): Keletso e Kopanetsweng: North Korea (DPRK) Masolo a Boenjiniere ba Sechaba a Lebisitse Baetsi ba Software (Contagious Interview / BeaverTail / InvisibleFerret).
• Palo Alto Networks Unit 42 (unit42.paloaltonetworks.com): Batšoantšisi ba Tšokelo ea Korea Leboea Lure Tech Ba batlang Mosebetsi e le Bahiri ba Fake (Contagious Interview Tlhahlobo).
• Federal Trade Commission (FTC) & Federal Reserve Board (United States): Keletso ea Bareki mabapi le Lits'oants'o tsa Boits'oaro ba Fake Check, Parcel Mules, le Regulation CC (12 CFR Part 229) Melao.
• Litšebeletso tsa Boahi ba U.S. le Bojaki (USCIS): myE-Verify Tataiso ea Tšireletso ea Boitsebiso ba Self Lock.
• Setsi sa Naha sa Ts'ireletso ea Cyber ​​(NCSC) & Action Fraud (United Kingdom): Ho Fokotsa Bobolokelo ba Khoutu e Lonya le Bomenemene ba ho hira.