The fake job interview that installs malware
Key takeaways The attack arrives at the assessment, which is the one stage in hiring where a candidate is expected to run someone else's code. Microsoft's Defender Experts team documents a campaign it calls Contagious Interview, in which fake recruiters get victims to clone and execute a package from a normal-looking repository. Presentation proves nothing. In the case BBC World Service reported…
The Contagious Interview scam preys on candidates during the assessment stage of the hiring process. Attackers pose as recruiters from cryptocurrency or AI firms, then instruct victims to clone and execute a package from a code hosting platform. This is a trusted route, leading victims to run malicious code on their personal machines.
The attack is sophisticated, involving social engineering and the use of digitally signed pages. Microsoft advises employers to provide virtual machines for coding tests, and job seekers should avoid executing unfamiliar code during assessments. The attackers aim to harvest credentials, such as API tokens, cloud credentials, and cryptocurrency wallets, often resulting in rapid financial loss for the victim.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
