Cyber Security

Your recruitment process is now part of your cybersecurity perimeter

A fake interview can persuade someone to run code on a personal computer. If that device also holds work accounts or data, a job-seeking scam can become an employer's security problem.

8 min read — Altitude IT Security Team

A candidate receives a promising message from a recruiter, is invited to a video interview and then sent a coding exercise or technical setup instructions. The next step may be to download a project, install a package or paste a command into a terminal. In a normal technical assessment those actions can be reasonable. In a fake one, they can be the delivery mechanism.

This is not only a problem for people looking for work. Employees often explore other roles while still employed, and a personal computer may also be used to read company email, access Microsoft 365, connect to a VPN or store work credentials. A compromised personal device does not automatically mean the employer has been breached, but it can create a route to accounts and information the device is allowed to reach.

IT Club explains how fake interviews can turn a coding test into a malware delivery route. This Altitude IT article looks at the employer-side question: what happens when the candidate's device also has access to work?

What the current advisory reports

A joint advisory published on 18 September 2026 by agencies in Japan, the United States, Australia and Germany describes the North Korean-linked group tracked as WaterPlum, commonly referred to as Contagious Interview. It says the actors pose as prospective employers, often impersonating AI, cryptocurrency or NFT companies, and target software developers and other IT professionals worldwide.

The advisory attributes the campaign to activity from around December 2025 through July 2026. It reports at least 30,000 PCs affected across more than 100 countries, funds or account credentials taken from over 7,000 cryptocurrency wallets, and at least 1.7 billion Japanese yen (US$10.71 million) in cryptocurrency exfiltrated from victims on behalf of North Korea.

Those are figures and attribution reported by the joint advisory, not measurements made independently for this article. “Over 7,000 wallets” does not mean every wallet was drained: the advisory says funds or account credentials were taken. The reported period also matters; these are cumulative figures for the activity it describes, not a claim that 30,000 devices were compromised in a single week.

The wider technique is straightforward: make a request feel like the next normal step in an interview. The candidate is already expecting instructions, files and technical tasks, so a project that would look suspicious out of context can appear routine.

How a personal-device compromise can reach work

Developers are used to cloning repositories, installing dependencies and running test code. Other candidates may be asked to install a meeting tool, open a document or troubleshoot a video call. If the instructions are malicious, the immediate device at risk may be a personal laptop, not a machine on the employer's network.

The company connection appears when that same device is also used for work. A browser may have a signed-in Microsoft or Google account, saved passwords or access to Teams, Slack, a CRM or a file-sharing service. A user may connect to a VPN or download work documents locally. What an attacker can obtain depends on the malware, device protections, account settings and permissions; an infection is not proof that every active session or business account is exposed.

Still, if a personal endpoint can reach business systems, the business has made a security decision whether or not it has written one down. That is why modern social-engineering guidance needs to cover more than suspicious email. Trust can be created on LinkedIn, a recruitment site, WhatsApp, GitHub, Teams or a video call. The setting—not just the link—can make the request feel legitimate.

Make work and personal access deliberate

For most SMEs, the simplest option is to use managed company devices for work accounts and sensitive work. Where BYOD is necessary, define which devices and applications may access company services, the minimum supported software, how authentication works and what happens when someone changes role or leaves.

The National Cyber Security Centre's BYOD policy guidance recommends deciding what access is permitted, what standards devices must meet and how controls will be enforced. It also notes that strong authentication, including MFA, is especially important where an organisation cannot apply the same device controls to a personal device.

Practical steps include:

Require MFA for Microsoft 365, email, VPN and other important accounts; use stronger sign-in controls where available.
Keep work credentials out of personal browsers and devices that have not been approved for business access.
Use managed company endpoints and endpoint protection for people who handle sensitive files or administer systems.
Limit accounts to the access needed for the role; do not make day-to-day accounts local or cloud administrators without a reason.
Separate work and personal activity where BYOD is allowed, and remove business access promptly when it is no longer needed.
Teach staff to report unexplained downloads, suspicious terminal commands or unexpected requests to disable security tools.

If a worker thinks they ran something suspicious, give them a clear route to report it quickly. IT can then assess the device, contain network access if appropriate, review relevant account activity and reset credentials or revoke sessions from a trusted device. Avoid making the employee wait for certainty or fear blame; a fast report is more useful than a quiet guess.

Recruiters need a safe and verifiable process too

Businesses can unintentionally create the same warning signs. Asking a candidate to download an unexplained executable, run a script they cannot inspect or use a personal account to access internal systems is difficult to justify as a routine test.

Make the process easy to verify: publish the vacancy on an official site, use consistent company email and meeting accounts, explain why each tool is needed, and give candidates a known contact route they can use to confirm a request. Prefer browser-based exercises or reviewed source code. If running code is genuinely part of the assessment, provide a controlled sandbox and clear instructions; do not ask candidates to disable antivirus or paste opaque commands into a personal computer.

For staff, awareness should include recruitment and social channels—not only email phishing examples. A message can be convincing because it fits what someone is trying to do. Training should make it normal to pause, verify the organisation through a separate trusted route and ask IT before running unfamiliar code.

Cyber Essentials is a baseline, not the whole answer

Cyber Essentials addresses common technical weaknesses through controls for firewalls, secure configuration, user access, malware protection and security updates. Those fundamentals reduce exposure if an endpoint is targeted, but certification does not make every candidate, personal device or recruitment workflow safe. Add clear BYOD and assessment procedures to the technical baseline.

A recruitment and endpoint checklist

Can people access work email or files from personal devices, and is that access intentional?
Are MFA, supported software, endpoint protection and least privilege in place?
Do staff know not to run unexplained commands or disable security tools for an interview?
Can an employee report a suspicious file or command without delay or blame?
Can candidates verify that a vacancy, recruiter and assessment belong to your organisation?
Are coding tests isolated from company systems and designed so candidates do not need to run unknown software on personal devices?

Your cybersecurity perimeter is no longer just the office firewall. It includes every place your people can be persuaded to trust someone—and every work account their devices can reach. A review of Microsoft 365 security, endpoint controls and security practices can help turn that into a manageable plan.