Наталя Хандусенко Work 17 August 2026, 12:18

"It was supposed to be a quiet day, but instead I'm cleaning my laptop": a fake interview almost cost a Ukrainian data developer his job

ReactJs / Native Developer Anatoly Shumov encountered a cyberattack disguised as a regular test task from a foreign company while searching for a job. Instead of the usual verification code, the received repository contained a hidden malicious script designed to steal personal data and gain remote access to the device.

Suspicious swagger.js and the 15KB threat

After several days of negotiations, potential employers sent Anatoly a link to a private repository with the basic structure of a full-stack application (Node.js API + React frontend). From the outside, everything looked completely standard, but before launching, the developer decided to check the contents of the files.

"Today was supposed to be a quiet day, but as a result, I'm cleaning my laptop," Anatoliy shared on LinkedIn. "Before running anything, I habitually looked at the code. And in the middlewares/swagger.js file — where the usual Swagger documentation configuration should be — I found about 15 KB of heavily obfuscated JavaScript."

Detailed analysis showed that the detected malicious code worked according to the scheme of a full-fledged dropper:

executed immediately when the file is connected (require), before the server starts and even without executing npm install$
creates a secret folder in the home directory and writes an additional payload there;
without the user's knowledge, it loads axios, better-sqlite3, node-machine-id, and socket.io-client;
The better-sqlite3 module is used to read Chrome, Brave, and Firefox databases that store passwords, cookies, and autofill. Meanwhile, the socket.io-client maintains a constant connection to the hackers' C2 server for remote command execution;
At the end, the file exports an empty middleware function so that the application runs without errors and does not arouse suspicion.

The described combination of actions coincides with hacking campaigns reported by researchers such as ESET under the name “DeceptiveDevelopment” (formerly the “Contagious Interview” cluster). The goal of such attacks is to steal passwords, SSH/cloud keys, and crypto wallets from developers. After being exposed, the recruiter immediately deleted the correspondence and his LinkedIn profile.

Recall that previously dev.ua reported on Russian hackers Sandworm, who are hunting Ukrainian IT specialists through fake interviews .

"In my case, everything ended with a complete reinstallation of the system, changing passwords, and revoking old keys. It seems that nothing critical was stolen, but the residue remained," the specialist noted.

Tips for IT professionals: how to avoid falling into the trap

To protect your work device from such threats, Anatoliy Shumov advises following several rules of cyber hygiene.

Inspect your code BEFORE running: Always inspect the contents of the repository files before running npm install or running the application itself.
Analyze inconsistencies: Pay attention to files whose name contradicts the content (for example, swagger.js without Swagger functionality is a direct red flag).
Use an isolated environment: It is safer to open test cases from unfamiliar companies in a virtual machine (VM) or Docker container, rather than on your main work PC.
Don't ignore obfuscation: the presence of obfuscated or encrypted JS code in a regular project is a reason to stop work and figure it out, rather than blaming it on the author's style.

They offered me a job, then sent me malicious code. Ukrainian developer talks about the fraudulent scheme

"They were ready to hire without an interview." Ukrainian developer warns of new scheme of attacks on programmers through fake vacancies

"Canadian company" suspicious offer and subscription for $7. Ukrainian designers spoke about a possible fraudulent scheme during employment at the IT company CarrotDevs