Ukrainian backend developer Serhiy Zgama has revealed that he was the victim of a cyberattack disguised as a job offer. According to him, unknown individuals contacted him on LinkedIn on behalf of the CEO of a consulting company and offered to join a new crypto project.
Ukrainian backend developer Serhiy Zgama has revealed that he was the victim of a cyberattack disguised as a job offer. According to him, unknown individuals contacted him on LinkedIn on behalf of the CEO of a consulting company and offered to join a new crypto project.
According to the developer, the person he spoke to talked about a crypto trading platform with AI features and multi-chain support, but it turned out that the product itself didn’t actually exist yet. Despite this, the rates and work schedule were agreed upon almost instantly — without any technical interview, experience check, or resume review.
The first suspicions arose after the invitation to GitHub came not from the account of the person who introduced himself as the CEO, but from a profile with a random set of characters in the nickname.
The developer did not run the project locally, but only viewed the repository files via the GitHub web interface. In the vite.config.ts file, he noticed a large block of obfuscated JavaScript code, which, he said, was hidden at the end of the configuration file. «This is not a bug or an unnecessary plugin — it is a malware template that executes itself as soon as someone runs npm run dev,» Zgama wrote.
According to him, this scheme has already become typical for attacks on developers. Attackers create fake job openings — most often in the areas of crypto, Web3, or AI — quickly «hire» a candidate without any background checks, and send a test project or GitHub repository with hidden malicious code.
The goal of such attacks can be to steal SSH keys, GitHub tokens, passwords saved in the browser, or private keys of crypto wallets.
After the developer started asking additional technical questions, the person he was talking to removed him from his LinkedIn contacts list.
Serhiy published correspondence with the fraudster.
Serhiy Zgama advises developers to be especially careful if:
He also recommends never running unfamiliar projects on your main workstation, previewing code via GitHub, and if necessary, using an isolated virtual machine without access to private keys, accounts, or crypto wallets.
