Fake jobs and test tasks
Lesson 12 of 16 in the course “Cybersecurity from Scratch”. Free, with animations and a quiz.
A $308 million test task
In May 2024 the Japanese exchange DMM Bitcoin lost $308 million. The FBI described how it started. A hacker posing as a LinkedIn recruiter messaged an employee at Ginco, the company that built the exchange’s wallet system. He sent a “pre-employment test”: a Python script. The employee ran it, and the attackers got into Ginco’s systems and, through them, DMM’s transfers. The FBI tied the attack to the North Korean group TraderTraitor.
It’s a wave, not a one-off
Since 2023, researchers at Palo Alto Networks have tracked a campaign they named Contagious Interview. Hackers linked to North Korea invite developers to “interviews” and hand them a project to download and run. Inside is a stealer that hunts for passwords and crypto wallets. Dan is a junior looking for work, exactly the target this is built for. Remember the five flags in the picture.
A sandbox for other people’s code
You don’t have to refuse every test task. You need to run strangers’ code where there is nothing to steal. That means a cloud dev environment, like GitHub Codespaces, or a virtual machine with none of your accounts. Remember that even npm install or pip install already run the package author’s scripts. So “I only installed the dependencies” is a run too.
If you’re not a developer
Everyone else gets their own version: “paid tasks”. Someone messages you offering to pay for liking videos or rating products. For the first days they honestly pay a few dollars so you trust them. Then they ask you to top up, usually in crypto, to unlock “better-paid” tasks. And in the end you must pay more to withdraw. The US FTC has issued specific warnings about this scheme. One rule: a job you pay for isn’t a job.
Check yourself
- A “recruiter” sends Dan a test: clone a repo and run npm install && npm start. What should he do?
Correct answer: Run it only in a cloud environment or a virtual machine. A sandbox has no passwords, sessions or wallet. Even if there’s a stealer inside, there’s nothing for it to take. - In a video interview Dan is told: “Your camera isn’t working, paste this command into the terminal”. What is this?
Correct answer: An infection attempt: real recruiters don’t do this. A terminal command can download and run anything. A browser button is all a camera needs. - Dan’s friend got paid for likes for two days, and now they ask her to deposit $100 to unlock better tasks. What should she do?
Correct answer: Don’t pay and walk away: it’s the “paid tasks” scheme. The first payouts are bait. After that, money only flows out.