NICKEL ALLEY Strategy: Fake iI 'Til You Make It
Sophos, March 23,2026
Victimizing software developers via fake companies, jobs, and code repositories to steal cryptocurrency
Counter Threat Unit (CTU) researchers continue to investigate trends in Contagious Interview campaign activity conducted by NICKEL ALLEY, a threat group operating on behalf of the North Korean government. The group notoriously targets professionals in the technology sector by advertising fake job opportunities, deceiving prospective candidates through a fake job interview process, and ultimately delivering malware.