They offered me a job, then sent me malicious code. Ukrainian developer talks about the fraudulent scheme
Developer Ivan Volos spoke about an alleged attempt to infect his computer with malware under the guise of a technical interview.
Developer Ivan Volos spoke about an alleged attempt to infect his computer with malware under the guise of a technical interview.
The developer told his story on LinkedIn. He was contacted by a user named Ryan Connor Lee, who introduced himself as the head of Mileage Investment Group and offered to join the creation of a Web-3 platform using artificial intelligence. But on the day of the interview, Ryan’s profile and their correspondence on LinkedIn disappeared, Volos claims. The scheduled call was answered by another person who did not properly introduce himself and immediately turned off the camera.
After half an hour of questions, the interviewer moved on to what seemed like a practical task. He sent a link to a repository on GitHub, and asked the developer to clone it, open it in VS Code, and run it. When asked about security, the interviewer assured that there was nothing dangerous in the project.
«You’ve already worked with the MERN stack, right?» he asked.
Instead of downloading, the IT guy checked the repository using the ScanRepo service. According to him, the tool rated its danger at 85 points out of 100 and marked the repository as malicious. Volos claims that he found obfuscated, that is, intentionally obfuscated code inside, as well as the use of the eval () function to load and execute remote scripts. But the most dangerous script the developer found in the tasks.json file. It was configured to run malicious code as soon as the user opens the folder in their editor.
The developer noted that the repository was called «Berchain-1/Jackpot.» Therefore, he suggested that the scammers could either have been using the name of the real blockchain community BerChain, or created an organization with a similar name specifically for this scheme.
«The moral of the story is simple. Be as critical as possible about such quick test tasks from no-names, especially since the era of such AI generated hacks is only developing. Never clone or open unverified repositories in your IDE, especially if they are Web3 startups. Always verify repositories or code before launching, because sometimes it is enough to just open a folder to lose access to your data.
«Take care of yourself, your devices, and your code,» warns Ivan Volos.
The described case is reminiscent of the Contagious Interview campaign, which Unit 42 researchers have linked to North Korean hackers. In this campaign, attackers also pose as employers and offer developers to download an infected repository, supposedly to complete a test task.
Therefore, experts advise not to run test projects from unverified employers on your work computer, but instead to perform tasks in an isolated environment, for example, in a temporary virtual machine. Also, check the repository and its owner, do not disable the editor’s protective functions, and leave unfamiliar folders in Restricted Mode.
Microsoft cyber experts study: Russian hackers infect Wi-Fi networks in hotels around the world
Microsoft cyber experts study: Russian hackers infect Wi-Fi networks in hotels around the world
Anatomy of a scheme: How an army of «workers» through Viber and Telegram bots devastates Ukrainians' cards on marketplaces
Anatomy of a scheme: How an army of «workers» through Viber and Telegram bots devastates Ukrainians' cards on marketplaces
Read the country’s main IT news in our Telegram
Read the country’s main IT news in our Telegram
