Хочете будувати кар’єру в Data Science та AI? Vodafone Big Data Lab відкриває новий набір —>
Наталя ХандусенкоWork
13 November 2026, 14:47
2026-11-13
"Poisoned interview": how a Ukrainian programmer was tried to be hacked during a regular live coding session
Software engineer Oleksiy Krychevsky almost became a victim of a cyberattack during a seemingly ordinary live-coding interview without any suspicious baits and sky-high salaries. Instead of testing his knowledge, the attackers slipped him a repository with hidden scripts for stealing data and gaining remote access to the PC. When the developer exposed the scheme, the company representatives promised to involve lawyers and asked not to disclose their names, but later they simply disappeared and stopped responding.
Software engineer Oleksiy Krychevsky almost became a victim of a cyberattack during a seemingly ordinary live-coding interview without any suspicious baits and sky-high salaries. Instead of testing his knowledge, the attackers slipped him a repository with hidden scripts for stealing data and gaining remote access to the PC. When the developer exposed the scheme, the company representatives promised to involve lawyers and asked not to disclose their names, but later they simply disappeared and stopped responding.
How it all began: a simple backend interview
An invitation came for a backend position in an Asian company. Without fabulous salaries and a million vacancies, everything looked as normal as possible. After a short theoretical part on JavaScript, the interviewer gave the task: "Clone the repository, do the task. Google can, AI can't."
However, they had already tried to trick Alexey before, so instead of the usual environment, he cloned the repository into the OrbStack container and worked through nano.
The interviewer frankly didn't like it: he persistently asked to open VS Code: "Dude, open VS Code. Our whole team works in VS Code."
After the developer refused and repeated reminders, the interviewer allowed him to continue, but within a few minutes he supposedly went to the "next meeting", after which the repository disappeared. In the local .vscode/settings.json file, the programmer found a surprise.
Anatomy of an attack: how a live coding trap works
Describing the technical component of the incident, the programmer noted that the scheme looks as ordinary as possible, but it conceals a serious threat.
“Imagine you are going through a technical interview. You are given a GitHub repository with a live coding task and prompted to open it in VS Code (or another editor based on it, which reads the settings from the same place as the original). It would seem that there is nothing unusual. But this is where the trap is hidden,” notes Oleksiy Krychevsky.
According to the IT expert, the repository contained the .vscode/settings.json file, where terminal profiles were hidden using a long strip of spaces, which replaced the built-in terminal launch command and secretly downloaded and launched malicious code via the shell.
"Everything then happens automatically. The script installs Node.js as needed, sends the attackers environment variables with potential keys and tokens, and then loads a full-fledged backdoor. And this is not just password theft. The found code can search for crypto wallets, SSH keys, .env and other secrets, read the clipboard, upload files and even open a remote terminal on your computer for the attackers," the developer warns.
The attack only failed because the engineer was working in an isolated container via nano and did not open VS Code. He published a full technical analysis of the execution triggers, data collection channels, and actual exposure limits in his technical analysis titled The Poisoned Interview .
Suspicious individuals and “ignore” from recruiters
At first, the communication was standard: recruiter Jessah Villabas from Kaelith Labs invited the programmer for an interview, and tech lead Vladyslav Buhera confirmed his role in the process. However, after Oleksiy asked the recruiter if she knew about their client's activities, the situation changed. At first, the company's representatives asked not to disclose the information and promised to sort it out through lawyers, but later they simply stopped contacting him.
"If they had gotten in touch and helped sort out the situation, my opinion might have been different. But we have what we have. I have serious suspicions that this is not a random incident, but a coordinated scheme, the purpose of which may be to steal personal data, personal files and photos, passwords, private keys, and gain access to crypto wallets," Oleksiy Krychevskyi summarizes, urging colleagues to avoid these people by all means.
