TraderTraitor (DPRK) front-company domains for fake job interviews: citalab[.]net / citalab[.]com, bitfit[.]io, oddium[.]io (SEAL, Nov 2026)
- Scam type: Phishing
- Project or site name: TraderTraitor / SEAL Radar
- Incident date: 2026-11-05
- Reported: 2026-11-05
- Last updated: 2026-11-05
Security Alliance (SEAL) published a TraderTraitor profile on 5 Nov 2026 naming four fictitious front-company domains used in 2026 fake-employer / fake job-interview campaigns against crypto engineers. The domains are listed as attacker-operated infrastructure, not as victim or exchange sites. Infrastructure: SEAL's non-exhaustive front-company list is citalab[.]net, citalab[.]com, bitfit[.]io and oddium[.]io. In the cluster SEAL describes as "Front Companies & Gitlab Repos", operators build employer fronts that survive basic diligence, then deliver a codebase during the interview process.…