#Vsrativakansii. Almost free SMM, top for 10,000 UAH, offer in exchange for viruses and AI at the interview, which was not there

Almost free SMM

CEO of «VANTABLACK» marketing agency Luka Tomovsky published a vacancy, which he calls a volunteer movement for ultra-low remuneration.

«4000 UAH for SMM, target, content, design and several other related professions… Judging by the vacancies, SMM is gradually turning from a profession into a volunteer movement. A little more — and the main requirement will be a sincere desire to help business…» he notes. The vacancy actually combines several roles: SMM, content maker, designer, business analyst, courier.

Top for 10,000 UAH

Konstantin Baran, Senior Information Technology Specialist, published a very strange and at the same time very cheap vacancy for a top manager.

«Looking for a top manager, maybe someone will be interested,» he wrote and added a screenshot of the ad.

When the previous candidate changed his mind

Recruiter Nadiya Zhurba spoke about an offer that seems to exist, but in reality does not. «A company that behaves as if it has been traumatized by a relationship:
Her ex dumped her, she had already started a new relationship, and then he suddenly came back with the words «I changed my mind,» she described her experience as a candidate and added a screenshot.

«Everything is beautiful here»

HR Director Yak Bozhyk continues to marvel at the creativity of employers in job postings. «Everything is great here. What a salary range, what tasks. I would call this vacancy HR Generalist, or, in an accessible language for people far from HR terminology, Recruiter-HR Specialist,» he wrote ironically and added a screenshot.

Offer in exchange for viruses

Developer Ivan Volos spoke about an alleged attempt to infect his computer with malware under the guise of a technical interview.

He was contacted by a user named Ryan Connor Lee, who introduced himself as the head of Mileage Investment Group and offered to join the creation of a Web-3 platform using artificial intelligence. But on the day of the interview, Ryan’s profile and their correspondence on LinkedIn disappeared, Volos claims. The scheduled call was answered by another person who did not properly identify himself and immediately turned off the camera.

After half an hour of questions, the interviewer moved on to what seemed like a practical task. He sent a link to a repository on GitHub, and asked the developer to clone it, open it in VS Code, and run it. When asked about security, the interviewer assured that there was nothing dangerous about the project. «You’ve already worked with the MERN stack, right?» he asked.

Instead of downloading, the IT guy checked the repository using the ScanRepo service. According to him, the tool rated its danger at 85 points out of 100 and marked the repository as malicious. Volos claims that he found obfuscated, that is, intentionally obfuscated code inside, as well as the use of the eval () function to load and execute remote scripts. But the most dangerous script the developer found in the tasks.json file. It was configured to run malicious code as soon as the user opens the folder in their editor.

Aitivets noted that the repository was called «Berchain-1/Jackpot.» Therefore, he suggested that the scammers could either have been using the name of the real blockchain community BerChain, or created an organization with a similar name specifically for this scheme.

«The moral of the story is simple. Be as critical as possible of such quick test tasks from no-names, especially since the era of such AI generated hacks is only developing. Never clone or open unverified repositories in your IDE, especially if they are Web3 startups. Always check repositories or code before launching, because sometimes it is enough to simply open a folder to lose access to your data. Take care of yourself, your devices, and your code,» warns Ivan Volos.

Technical interview without any technical questions

Senior Frontend developer Mykola Sutkovy shared a story about a strange experience during the recruitment process. Instead of the usual assessment of hard skills, the technical interview turned into a short conversation about the situation in Ukraine and ended with a standard rejection.

As Mykola Sutkovy told LinkedIn, he received a direct invitation to the technical stage, bypassing the initial communication with HR. According to him, the stacks and requirements in the vacancy coincided 100% with his relevant experience — down to specific libraries, such as ag-grid, which the developer had already worked with before.

According to the original plan, the hiring was to consist of two stages: a technical interview with the tech lead, and then a technical interview with the client.

However, the first meeting lasted only half an hour. The Backend Team Lead appeared for the interview, immediately stating that he was in charge of the backend department, and briefly presented the project via a screen demonstration.

The rest of the time, the developer and the tech lead discussed the general state of affairs, the difficult job search situation, the number of responses to the vacancy, and the situation in Ukraine.

There were no technical questions or skills tests during the 30-minute session, but the interviewer promised to provide feedback within three days.

As a result, five days later, the IT worker received a standard rejection letter stating that the company had chosen a candidate whose experience «more closely matches the current needs of the project»: «After careful review of your background and a thoughtful discussion with the hiring team, we have decided to move forward with other candidates whose experience more closely matches what we are looking for at this stage.»

The AI ​​that didn’t exist

Full-stack Engineer Stanislav Gogulya encountered a situation that surprised even experienced professionals. It seems that recruiters have found a new convenient excuse for rejection instead of meaningful feedback.

As Stanislav Gogulya told on LinkedIn, at first everything went according to the classic scenario: a successful HR stage, two days to complete the test task, and a technical interview, where the IT professional felt confident.

Later, a letter from the company arrived in the mail, which stated: «It was a pleasure to talk to you — you made a good impression on our team! However, during the assessment, we noticed that some of the answers could have been enhanced with the help of AI tools, which made it difficult for us to objectively assess your real level of technical knowledge.»

Stanislav was surprised by this wording, because he answered the interview himself.

«Silence or lack of feedback during a job search no longer surprises anyone. But this was something new, because I was the one answering,» the developer shared.

When the IT worker tried to clarify with the recruiter what exactly aroused suspicions and what the «assistance of artificial intelligence» was, he never received an answer.

For him, this seems like a convenient new way to reject candidates without explaining the real reasons.

«It was supposed to be a quiet day, but instead I’m cleaning my laptop»

ReactJs / Native Developer Anatoly Shumov encountered a cyberattack disguised as a regular test task from a foreign company while searching for a job. Instead of the usual verification code, the received repository contained a hidden malicious script designed to steal personal data and gain remote access to the device.

After several days of negotiations, potential employers sent Anatoly a link to a private repository with the basic structure of a full-stack application (Node.js API + React frontend). From the outside, everything looked completely standard, but before launching, the developer decided to check the contents of the files.

«Today was supposed to be a quiet day, but as a result, I’m cleaning my laptop,» Anatoliy shared on LinkedIn. «Before running anything, I habitually looked at the code. And in the middlewares/swagger.js file — where the usual Swagger documentation configuration should be — I found about 15 KB of heavily obfuscated JavaScript.»

Detailed analysis showed that the detected malicious code worked according to the scheme of a full-fledged dropper:

• executed immediately when the file is connected (require), before the server starts and even without executing npm install$
• creates a secret folder in the home directory and writes an additional payload there;
• without the user’s knowledge, it loads axios, better-sqlite3, node-machine-id, and socket.io-client;
• The better-sqlite3 module is used to read Chrome, Brave, and Firefox databases that store passwords, cookies, and autofill. Meanwhile, the socket.io-client maintains a constant connection to the hackers' C2 server for remote command execution;
• At the end, the file exports an empty middleware function so that the application runs without errors and does not arouse suspicion.

The described combination of actions coincides with hacking campaigns reported by researchers such as ESET under the name «DeceptiveDevelopment» (formerly the «Contagious Interview» cluster). The goal of such attacks is to steal passwords, SSH/cloud keys, and crypto wallets from developers. After being exposed, the recruiter immediately deleted the correspondence and his LinkedIn profile.

«In my case, everything ended with a complete reinstallation of the system, changing passwords, and revoking old keys. It seems that nothing critical was stolen, but the residue remained,» the specialist noted.

Microsoft cyber experts study: Russian hackers infect Wi-Fi networks in hotels around the world

On the topic

Microsoft cyber experts study: Russian hackers infect Wi-Fi networks in hotels around the world

Anatomy of a scheme: How an army of «workers» through Viber and Telegram bots devastates Ukrainians' cards on marketplaces

On the topic

Anatomy of a scheme: How an army of «workers» through Viber and Telegram bots devastates Ukrainians' cards on marketplaces

Read the country’s main IT news in our Telegram

On the topic

Read the country’s main IT news in our Telegram