Senior Frontend Engineer Denys Bilousenko shared his own story of confronting hackers who tried to steal his personal data under the guise of a job offer. The scheme, known in the cybersecurity field as Contagious Interview, is aimed at Web3 and IT professionals.
Senior Frontend Engineer Denys Bilousenko shared his own story of confronting hackers who tried to steal his personal data under the guise of a job offer. The scheme, known in the cybersecurity field as Contagious Interview, is aimed at Web3 and IT professionals.
According to Denis, it all started with a compelling message from a “recruiter” on LinkedIn. He was offered a Frontend Engineer position for the decentralized GameFi platform in partnership with a real Web3 company, Limit Break. The message contained specific mentions of his skills (React, Next.js, TypeScript) and details from his profile.
The next step was for the IT guy to "get to know the project": clone the repository with the code and run it locally.
"I received a message on LinkedIn from a "recruiter"... It was written convincingly, they mentioned my React, Next.js, TypeScript, even specific things from my profile. Remote, full-time or part-time. Everything as it should be. Then they asked me to "get acquainted with the project": clone the repository and run it locally, look at the architecture. And here I already knew it was a scam," notes Denys Bilousenko.
The invitation to the project came from the email address [email protected]. Although Gabriel Leydon is indeed the CEO of Limit Break, his official corporate contacts are located at the @limitbreak.com domain, not on the third-party Gmail service.
Despite the neat project structure and clean code in the repository, a threat lurked in the dependencies.
"The project looks like a regular React/Node application, clean code, normal structure, even the README is neat. But somewhere deep in the dependencies lies an obfuscated script, disguised, for example, as a Tailwind CSS plugin. When npm install or npm run dev, it silently collects passwords from browsers, crypto wallet data, SSH keys, .env files, GitHub and AWS tokens. Everything flies to an external server. From git clone to a hacked machine in less than five minutes," explains the Senior Frontend Engineer.
"This scheme is known as 'Contagious Interview'. Microsoft and several security teams link it to the Lazarus group (North Korea). Target: developers, especially those in crypto/Web3 or who are looking for work," the IT expert notes.
Denys Bilousenko highlighted the main signs by which you can recognize scammers:
The "recruiter" writes from free email services (Gmail, etc.), not from the official corporate domain;
you are asked to clone and launch the project before the first full interview or video call;
the code is placed in a private or newly created repository;
The message text completely duplicates the list of skills from your profile.
“I recognized it right away because I had read similar stories from other people before… It was thanks to these people that I knew what it was, even before I opened the entire message. It really works. That’s why I’m sharing it. If anyone you know is currently looking for a job or working in Web3, please forward it. Take care of your machines,” the developer concluded.
