Trifleck
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5wvN6L…jizJSummary
Trifleck is a shell company with no verifiable business registration used as a front in an active LinkedIn-based malware campaign targeting crypto and Web3 developers, first publicly disclosed in May 2026. The campaign delivers a malicious 'pre-interview code review' ZIP file containing infostealers after recruiters posing as Trifleck employees contact developers with frontend job offers. The attack pattern, infrastructure, and malware families are consistent with tactics attributed by Microsoft, Mandiant, Palo Alto Unit 42, and the FBI to DPRK-aligned threat actors operating under the cluster known as Contagious Interview.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(11 events)
23 March 2022
Ronin Bridge drained of approximately $620 million by Lazarus Group via spear-phishing initial access, establishing the scale of damage possible from fake-recruiter playbooks.
CoinDesk / FBI attributionDecember 2022
Contagious Interview cluster first documented as continuously active, per Microsoft Threat Intelligence.
Microsoft Security Blog22 July 2023
CoinsPaid loses $37.3 million in a Lazarus-attributed attack that began with a fake job offer and malicious interview task delivered to an employee.
BleepingComputer25 April 2025
FBI seizes Blocknovas LLC domain; CoinDesk reports North Korean hackers created at least two fake U.S.-registered shell companies (Blocknovas LLC, Softglide LLC) to distribute malware via fake developer job interviews.
CoinDesk21 May 2025
trifleck.com and fleckpublisher.com domains registered within 3 hours 10 minutes of each other via Namecheap, using Icelandic WHOIS privacy proxy.
Cyber Secify investigation11 March 2026
Microsoft publishes detailed technical analysis of the Contagious Interview malware cluster, documenting OtterCookie, BeaverTail, InvisibleFerret, and FlexibleFerret payloads and the npm lifecycle hook delivery method.
Microsoft Security BlogApril 2026
Drift Protocol exploited for approximately $285–286 million following a multi-month DPRK social engineering operation; attributed with medium confidence to North Korean state actors by Elliptic and TRM Labs.
The Hacker News16 April 2026
Microsoft publishes macOS-specific analysis of Sapphire Sleet intrusion chain using fake Zoom SDK updates, documenting theft of crypto wallet keys, SSH keys, and macOS keychain data.
Microsoft Security Blog6 May 2026
Anil N, a senior frontend engineer in Bengaluru, receives a LinkedIn connection request and direct message from 'John Burleson', claiming to be COO at Trifleck, offering a $50–$100/h frontend role.
Cyber Secify18 May 2026
Cyber Secify publishes first public disclosure of the Trifleck shell company and the Blockstar.zip malware delivery campaign, identifying four shell fronts sharing common infrastructure.
Cyber Secify26 May 2026
Crypto Times publishes broader analysis of the Web3 fake job interview threat landscape, reporting $17 billion in global crypto scam losses for 2025 and a 1,400% year-over-year rise in impersonation attacks.
Crypto TimesDecision Log
- slot 443513059 · hash CaaaMPf78STEPdkMBQExA1uHUdACmKkJ16mJ68ut5cxS
- slot 443513053 · hash 9pNB7z1AwcqSiNT88TMDBf9xJTPBQ56Er15qNr8y6EBN
- slot 422622585 · hash DVYer123EaGVZVq5PVcKHPjersZvFC5Mxj8mcD3RWMMP
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 12 of 12 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/28/2026, 1:44:01 AM
last updated: 8/25/2026, 9:05:13 AM
7 viewsavoid.net — verified advice for a post-truth world