How North Korea Pays its Bills by Creating a Human Botnet

In 2026, DPRK campaign "PolinRider" compromised over 6,000 GitHub repos and 2,100 individuals by weaponizing trusted developer identities and workflows. It represents the industrialized next phase of Contagious Interview, turning crypto-theft hiring scams into a persistent pipeline that converts individual developer compromises into mass software supply-chain propagation. Our research indicates many victims didn't just get hit once and recover. Rather, a meaningful subset remained compromised or became re-compromised over time, giving DPRK a long-lived pool of developer endpoints, credentials, and GitHub identities. This talk covers how PolinRider works and core detection engineering techniques you can use to hunt and identify these attacks.