Fake job interview code drops RAT, steals browser wallets and SSH keys
How to compromise your system with a job interview
A phishing attack disguised as a coding challenge for a job interview infected a developer's system with a remote access trojan and credential stealer. The malicious code, sent via LinkedIn and Bitbucket, executed a remote loader that pulled a RAT, browser and crypto wallet stealer, file grabber, and clipboard monitor from a command-and-control server. The malware accessed SSH keys, AWS credentials, browser profiles, and wallet data without elevation, exploiting user-level access. The attacker impersonated a company that has since published a security notice.
You opened the door to hell while you just wanted to get a job.
- ShinyLeftPad
> Putting things into Docker and only executing the code inside isolates your host system and does not reveal any stored secret - as long as you do not mount host data into the container.
Doesn't mention why... Gives no similar warning about VM.
You usually have to mount at least some data in a container or VM for it to be useful. Of course, being an idiot and sensitive mounting secrets in untrusted environment is the problem, container or VM doesn't matter.
Maybe it means there's some 0day where mounting any volume allows container escape or something? But that's not what it says.
- _carbyau_
The internet world really does run on trust-chaining reputation.
A person who takes random things from a near stranger on the internet and runs it on their computer with no real safeguards is not a person I should hire.
Which also means that your hiring practice should not involve a person you met on zoom/Teams/whatever 10 minutes ago being required to run your random crap without safeguards.
Which means if you want them to download and run stuff, you should list the requirements so the applicant can decide if they are going to do that for you.
But we don't live in such an ideal world....
- john_strinlai
out of the list under "Before you start with the test, you might be suspicious about the following:" there is only one that is important:
only interact with people using an official email address.
the rest can be used as yellow/red flags, but simply asking for confirmation via an official email address will thwart the vast majority of scams (including other ones, like someone claiming to be from Intuit calling about your QuickBooks or whatever).
- shahbaby
If a company is not even willing to have a real person speak to you at the start of the recruitment process, what does that say about them? Or about the legitimacy of that job posting? Or about the people you would be working with if you did get hired?
Regardless if you get an offer or not, you will invest a significant amount of finite time in each interview cycle and if you do get an offer, you'll be investing even more time into that company.
So no matter who you are, protect your time and remember that interviewing is always a 2-way street.
- forinti
> “A relevant opportunity” with part-time remote work and a great hourly compensation
That is so suspicious at the moment.
- gfalcao
My first thought after reading the article: develoepers NEED to learn to use firewalls such as LuLu(https://objective-see.org/products/lulu.html) to get interactive dialogs asking whether any given binary can access any given internet address whether it is a domain address or IP address (which can seem even shadier).
I am an Emacs user but every time I have tried a new editor, including VS Code or VSCodium I blocked access to remote addressed which were prompted to me even though I did not neither authorize extension download nor extension download.
I think it would have been even funny for devs trying out for code challenges while using "interactive" firewalls such as LuLu, then catching the shadiness and blocking access right up.
- aliasxneo
I get enough legit and illegitimate ones every week on LinkedIn that it's become really easy to tell the difference. Hard to pinpoint in a comment because it's mostly a gut feeling. But, in rough order:
1. Look at the person's LinkedIn profile contacting you and examine their post history. In one comical scenario the "recruiter" had a long 4 year gap where they were writing comments in English and all of the sudden they switched to Spanish. Mostly short, pointless comments as well.
2. Look at the company and make sure they have a legitimate website and are still actually in business. Even better, see if there's a public team page that lists this person.
3. Give the recruiter an email (I usually use something like SimpleLogin) and ask them to forward you the details. Of course, pay close attention to what address they send it from.
4. In addition, or alternatively, ask the recruiter for the public job listing (scammers almost always "paste" it into a DM or upload a clearly AI generated PDF doc).
Once you learn the game it's not too hard to start picking up on them. I've made it a game to play along sometimes just for fun. Ultimately, at the end of the day, make sure you report them on LinkedIn. I've had the account disappear within a hour of doing so.
- mapmeld
Since no one mentioned it - this seems to be a major and real problem in the crypto job space. In their job market it's more believable that a 'stealth startup' is reaching out and doing a code challenge from an unfamiliar email or repo, and crypto devs are likely to have a wallet or passwords accessible on their system. They are willing to go above and beyond the regular spam or AI conversations to get access.