North Korean IT scammers thwarted by Amazon, updated BeaverTail malware surfaces

Over 1,800 suspected North Korean scammers had their attempts to obtain remote IT work at Amazon quashed since April 2024 as the firm recorded a 27% quarter-over-quarter increase in North Korea-linked job applications, The Register reports.

While Amazon has leveraged AI-based screening, which examines links with almost 200 high-risk organizations, application errors, and geographic anomalies, alongside background checks, structured interviews, and credential verification to thwart fraudulent IT workers, the increasingly prevalent impersonation of legitimate software engineers via breached credentials has presented new challenges, said Amazon Chief Information Security Officer Steve Schmidt.

"Implement identity verification at multiple hiring stages and monitor for anomalous technical behavior: unusual remote access, unauthorized hardware," Schmidt added.

Such a development comes as Darktrace researchers reported the emergence of a more clandestine variant of the North Korea-linked BeaverTail infostealer and malware loader. Apart from featuring over 128 obfuscation layers, the updated BeaverTail malware also utilized decoy payloads for additional stealth.