North Korean Phishing Emails: Spot Fake Jobs, QR Traps & Malware

Updated 7 November 2026 · Standard formula, shown below

North Korean phishing emails often pose as job offers, IT vendor inquiries, or security alerts to trick you into opening malware-laden attachments, scanning malicious QR codes, or handing over credentials. Recognizing them means checking the sender, the urgency, and the payload—and never trusting a link or attachment from an unsolicited message. Below is a practical breakdown of how these attacks work and how to defend against them.

Why North Korean Phishing Targets You

State-linked groups from North Korea (commonly tracked as Lazarus, APT38, or Kimsuky) run phishing campaigns for two main reasons: stealing money and stealing data. They have targeted cryptocurrency exchanges, defense contractors, journalists, and even individual job seekers. Their emails are often more polished than average spam because they invest time in research—they may reference a real company, a real recruiter, or a real conference. The goal is usually one of three things: get you to open a macro-enabled document, get you to click a credential-harvesting link, or get you to scan a QR code that leads to a phishing page.

How Fake Job Offers Work

A common tactic is the “remote developer” or “blockchain researcher” job offer. The email looks like it comes from a legitimate HR department, often with a well-crafted resume of the company and a salary range that seems generous. The catch is the next step: they ask you to download a coding test or a PDF that actually contains a malicious macro or a link to a fake login page. In some reported cases, the “interview” is conducted over a messaging app, and the “test” is a Visual Studio project with a hidden payload. If you receive an unsolicited job offer that asks you to run code or open a macro before a real conversation, treat it as hostile.

QR Code Traps in Email

QR codes are increasingly used because they bypass many email security filters—the URL is hidden inside an image. A phishing email might say, “Scan this code to verify your identity” or “Scan to view your secure message.” When you scan it with your phone, you land on a page that looks like Microsoft Outlook or a corporate VPN login. If you enter your password, it goes straight to the attacker. The QR code itself cannot install malware, but the page it leads to can trick you into downloading a malicious app or entering credentials. Never scan a QR code from an unsolicited email, especially if it asks for a login or a download.

Recognizing the Malware Payloads

When the attacker succeeds, the payload is often a remote access trojan (RAT) or a keylogger. A common delivery method is a Word document with a macro that downloads a second-stage payload from a compromised server. Another is a JavaScript file disguised as a PDF. In recent campaigns, attackers have used “chm” files (compiled HTML help) and even OneNote attachments. The malware typically does not do anything visible immediately—it waits, captures keystrokes, takes screenshots, and sends data back to a command-and-control server. If you suspect a file is malicious, do not open it. Upload it to a service like VirusTotal (which is a legitimate, widely used scanner) or run it in a sandboxed environment.

How to Spot the Red Flags

Sender domain: Check the full email address, not just the display name. A “@gmail.com” address claiming to be from a bank is a red flag.
Urgency and secrecy: Phrases like “confidential project,” “immediate action required,” or “do not share this with anyone” are common pressure tactics.
Unusual attachments: A .zip, .docm, .js, or .exe file in a job application is not normal. Legitimate recruiters send links to their own portals.
QR codes in emails: Legitimate companies rarely ask you to scan a QR code from an email to log in. If they do, verify through a separate channel.
Poor grammar but not too poor: North Korean phishing often has subtle errors—wrong prepositions or awkward phrasing—but it is usually readable, not the “Nigerian prince” level.
Mismatched URLs: Hover over any link (without clicking) to see the actual destination. A link that says “https://microsoft.com” but points to “http://microsoft-security-verify.com” is fake.

What to Do If You Receive a Suspicious Email

Do not click any links, download any attachments, or scan any QR codes.
Do not reply to the email. Replying confirms your address is active and invites more attacks.
Report it to your IT department (if at work) or forward it to your email provider’s abuse address (e.g., abuse@gmail.com).
If you already clicked a link or entered a password, change that password immediately and enable two-factor authentication (2FA) on the account.
If you scanned a QR code and entered credentials, treat the account as compromised and follow your organization’s incident response plan.
If you opened an attachment, disconnect the device from the network and run a full antivirus scan. Consider a clean reinstall if you suspect a RAT.

Common Misconceptions

One misconception is that North Korean phishing always comes from a .kp domain. It rarely does—attackers use free email providers, lookalike domains, or compromised legitimate accounts. Another is that antivirus software will catch everything. Many payloads are custom and undetected by signature-based scanners. A third is that these attacks only target big companies. Individuals are often targeted as a stepping stone to a larger organization (e.g., a freelancer who works with a defense contractor). Finally, some believe that QR codes are safe because they are just images—but they are a vector for phishing just like links.

Frequently Asked Questions

Can a phishing email install malware just by opening it?

Generally, no. Modern email clients do not execute code just by displaying a message. The risk comes from opening an attachment or clicking a link. However, there have been rare cases of zero-click exploits in email clients, but those are not typical of North Korean campaigns. The safer rule is: if you did not expect an attachment, do not open it.

What should I do if I already clicked a link in a suspicious email?

Immediately change the password for the account you were on, and any other account that uses the same password. Enable 2FA if you have not. Run a malware scan on your device. If you entered financial information, contact your bank. If you are at work, alert your IT security team right away—they may want to monitor for lateral movement.

Are QR codes in emails always dangerous?

No, but they are a red flag. Legitimate companies sometimes use QR codes for event check-ins or two-factor enrollment, but they rarely send them via email asking you to log in. If the email is unsolicited or creates urgency, treat the QR code as malicious. You can also inspect the QR code’s URL by using a QR scanner that shows the destination before opening it.

How do I verify if a job offer is real?

Contact the company directly using a phone number or email address from their official website—not the contact details in the email. Search the recruiter’s name on LinkedIn and see if they have a history. Ask for a video call with a real person. Legitimate recruiters will not ask you to run code or download a file before a formal interview. If they do, it is almost certainly a scam.

What is the difference between North Korean phishing and normal phishing?

North Korean phishing is more targeted and patient. It often involves research on the victim, custom lures (like fake job tests), and a focus on cryptocurrency or defense secrets. Normal phishing is a numbers game, blasting thousands of people with generic “your account is locked” emails. The defense is the same, but the stakes are higher with state-backed actors.

Can I safely open a QR code from a known contact?

Only if you are sure the contact’s account has not been compromised. Attackers often hijack legitimate accounts and send QR codes to everyone in the contact list. If a friend sends you a QR code with a message like “scan this to see my photos,” verify through a separate channel (like a phone call) before scanning. When in doubt, don’t.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.