I Inspected My Take-Home Interview Project. It Was a Whole Operation
A recruiter offered me an unusually high-paying Python role with a take-home assignment. Suspicious of the lack of vetting, I inspected the provided zip file and discovered malicious Git hooks designed to silently execute remote payloads. The attack chain installs Node.js dependencies like Hardhat and clipboard access tools, likely targeting crypto wallets. This sophisticated scam repurposes innocent open-source code to infect candidates' machines.
This is just a habit (may be from doing CTFs), whenever I get a random project folder, I just run tree -a to see what's lurking in the hidden directories.
- IvanGoncharov
Wow, after reading this article, I figured out I was hacked, but with a way more sophisticated attack.
A few weeks ago, I had an interview with a CTO of a totally legit company.
It was weird because he had disabled the camera, and the person had a strong accent.
But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about.
At the end of the interview, he explained to me that during the technical interview I would need to make some modifications to their project (it's an OSS product), so he asked me to clone the repo and check the setup.
Later, the HR person said the CTO got sick, so the interview would be postponed.
But a few days later, the HR profile was deleted from LinkedIn.
It was super weird, but it didn't trigger my suspicion until I saw this post on HackNews.
I checked, and the repo I was cloning and running during the interview had a malware payload.
P.S. I think it was a targeted attack because in the past I maintained a very popular NPM package with 43+M weekly downloads. That's my only explanation for why someone would carry out such a sophisticated social-engineering attack against me.
P.P.S. It's great that I have 2FA everywhere, and I always publish NPM packages manually without using tokens. But I need to wipe my laptop and reinstall everything.
- petterroea
Recently there seems to be an uptick in North-Korean attacks against developers. In addition to this type of attack, which has been going on for years, I recently get ~1 email a week from North Korean hackers. It's always a "Hello, I found your profile, want to collaborate?" e-mail.
Discord communities I am in for programming are similar. People show up and within a few days either ask for a job or suggest cooperation. Sure, you could argue these Discord people may actually be out of a job (in this economy, very likely), but the volume and similarity of the messages say otherwise. You can also tell people show up in... _weird places_ to ask for jobs. An example being the Discord community for a not-really-used Python library with ~0 actual activity - either this person is very bad at finding good places to jobhunt or some attacker is just crawling a list of Discord communities and attacking them all.
It's a shame but there are a _lot_ of attacks that abuse our trust in each other nowadays. A good reminder to, like mom and dad said, never trust strangers on the internet
- wxw
> They embedded a script that checks the victim’s host operating system and silently executes a remote payload.
Seems like this is becoming a recurring theme, similar story was on the front page last month.
- vardalab
My takeaway from this was that Claude was being completely useless as a helper Thanks to all the safety safeguards and that nonsense.
- ivanjermakov
> Why use a raw IP address? If anything, this screams “malware.”
If the victim is deep enough to check hook's content, it's unlikely they will just stop here losing suspicion. I'm sure most devs wouldn't think that doing `git commit` can be malicious (git security oversight?).
- CM30
Hmm, did anyone else have issues loading the screenshots here? I had to open most of them in a new tab to see them.
Regardless, that's a pretty sneaky scam, and definitely something that caught out a ton of would be candidates in the past. What's more, the Visual Studio Code project mentioned in the article sounds even more horrifying. Like, the tool seriously lets you run custom code whenever someone opens your project? That feels like a really blatant malware vector that should probably have at least some sort of security mitigation...
It's also rather worrying how little these job sites are doing about scams like this too. I get it, it's perhaps a bit difficult to catch out all kinds of wrongdoing here. But you'd think it'd be simple enough to restrict accounts from claiming to be associated with a company or organisation if there's no proof they work there. At the moment, you can basically claim to work for any company you like, or that you have any type degree from any institution under the sun. If this was verified in any real way, and messages had a large warning at the top if the original claiming to be from an organisation wasn't confirmed to work there, a lot of scams would far more difficult to pull off.
- nphardon
always a good day when we get an a post on front actually related to hacking on hackernews.
- lantry
> Side note: Why use a raw IP address? If anything, this screams “malware.” At least register a decoy domain like lint-checker.com or jenkins-ci-runner.net. If the threat actors who wrote this are reading: take notes people!
Maybe they don't want to give any identifying info to the domain registrar? Or just minimizing their online presence?