Q: What are the most common signs and how to spot fake job interviews? A: Watch for lookalike or free email domains, refusals to meet live, repeated camera or audio issues, requests for crypto or deposits, and tests that require running installers or enabling macros. The WaterPlum advisory shows attackers use those tactics to deliver malware, compromise devices, and steal credentials and crypto wallets. Q: How did the WaterPlum campaign infect devices and steal funds? A: Agencies reported WaterPlum operators posed as recruiters, sent bogus coding tests that installed remote access trojans and information stealers when opened. They compromised more than 30,000 devices, over 7,000 cryptocurrency wallets, and are attributed with at least $10.71 million in thefts supporting the North Korean regime. Q: What file types or delivery methods should raise red flags for take‑home tests? A: Decline zip files, ISO images, .exe/.pkg installers, password‑protected archives, or any test that asks you to enable macros or grant admin rights, since these are common malware vectors. Ask for a public repo, a browser‑based IDE, or a read‑only document instead and only open unknown files in a sandbox or throwaway device. Q: What video behaviors indicate deepfake or impersonation during an interview? A: Look for visual artifacts such as flicker, odd lighting, lip‑sync drift, sudden camera disablement, background voices feeding answers, or awkward speaker switching. Request liveness checks like turning the head or reading a code, and be wary if someone insists on turning off video shortly after starting. Q: How should jobseekers protect crypto and credentials while interviewing? A: Keep real wallets and seed phrases off any job‑hunting device, use testnets or burner accounts for demos, and turn off clipboard syncing to avoid info‑stealers. Also use unique passwords with a password manager, enable MFA (prefer authenticator apps or hardware keys over SMS), and routinely revoke connected app access. Q: If I suspect a fake interview compromised my device, what immediate steps should I take? A: Disconnect the device from the internet and, if possible, isolate it without powering off to preserve evidence, then from a clean device change passwords and revoke active sessions on email, GitHub, Slack, cloud, and exchanges. Rotate API tokens and SSH keys, run a reputable antivirus or EDR and consider a full rebuild if malware is found, and report the incident to your employer and relevant authorities such as the FBI IC3 in the US. Q: What hiring process changes can employers make to prevent credential theft from interviews? A: Deliver tests via company‑owned platforms, use browser sandboxes or read‑only repos, prefer live pairing sessions in a shared IDE, and verify identities with liveness checks and domain‑based email. Harden endpoints for interviewers and HR by removing local admin, enabling EDR and email attachment scanning, and using least‑privilege, short‑lived credentials for trials. Q: How do I verify a recruiter’s identity and avoid falling for lookalike domains? A: Confirm the person’s profile and role on the official company website and LinkedIn, comparing job title, photo, and employment dates, and study the email domain since legitimate recruiters rarely use free addresses. Validate by requesting a quick call on the company’s main number or a calendar invite from the corporate domain and type company URLs yourself rather than following shortened links.