If a “tech interview” needs you to clone a repo or run npm before you’re hired, stop - especially if the face glitched and the cam died

IC3’s CSA says this activity hit at least 30,000 devices in more than 100 countries around December 2025 through July 2026, with funds and credentials from over 7,000 crypto wallets, and about 1.7 billion JPY (10.71 million USD) moved toward DPRK. Cite the advisory. It is pattern education, not a verdict on any one chat you are in. Not every remote interview is this campaign.

End the call. Do not run their code. If you already did: take that machine offline, assume browser and wallet material may be gone, change passwords from a clean device, move remaining crypto to a new wallet created on a clean device, and report at https://www.ic3.gov/. Companies: verify applicants on a channel you already trust, use least privilege, and do not open unknown VS Code folders with full trust.

A coding test that arrives before an offer is not a shortcut to the job. It is often the job - for them.

IC3 CSA (September 18, 2026): https://www.ic3.gov/CSA/2026/260918.pdf