Fake job interview code drops RAT, steals browser wallets and SSH keys

How to compromise your system with a job interview

A phishing attack disguised as a coding challenge for a job interview infected a developer's system with a remote access trojan and credential stealer. The malicious code, sent via LinkedIn and Bitbucket, executed a remote loader that pulled a RAT, browser and crypto wallet stealer, file grabber, and clipboard monitor from a command-and-control server. The malware accessed SSH keys, AWS credentials, browser profiles, and wallet data without elevation, exploiting user-level access. The attacker impersonated a company that has since published a security notice.