North Korean Hackers Deploy Mac Backdoors via Fake Job Tests Targeting IT Firms

• •North Korean hackers used fake job tests to deploy macOS backdoors FLATROOF and ROOFDECK.
• •The attack targeted an Indian IT services provider, compromising sensitive cloud credentials.
• •Organizations should treat recruiter-supplied code as untrusted and implement strict verification processes.

North Korean threat actor Jade Sleet, also known as TraderTraitor, has been linked to a breach of an Indian IT services provider using macOS backdoors named FLATROOF and ROOFDECK. The attack involved social engineering tactics, where fake job interview assignments were used to lure DevOps engineers into executing malicious Terraform commands. SentinelOne discovered that the backdoors were present on a compromised Mac, which contained sensitive cloud credentials. The malware can perform various malicious activities, including data exfiltration and lateral movement within networks. The attack highlights the ongoing threat posed by state-sponsored actors targeting the IT sector. The breach was detected after the developer opened a malicious workspace in March 2026, with the backdoors becoming active shortly after. Organizations are advised to treat external coding assignments as untrusted and to verify dependencies before execution.