North Korean cybercriminals lured IT job seekers to take fake skills assessment tests on malicious websites in a new social engineering campaign, according to Microsoft researchers, in what one expert called a likely attempt to extort victims.

The unit under the DPRK’s Lazarus Group, which Microsoft tracks as Sapphire Sleet, set up the “skills assessment portals” to lure targets from legitimate platforms like LinkedIn, Microsoft Threat Intelligence wrote in a recent series of social media posts.

After establishing contact with a victim, the cybercriminals use “lures related to skills assessment” to move communications with