Uncovering How Cybercriminals Are Exploiting The Employment Market

The talk examines a malware campaign that uses fake recruiters on LinkedIn, Upwork and Fiverr to lure developers. The offers promise generous remote work paid in cryptocurrency, and candidates are asked to complete a coding assessment hosted in a repository. The presenter recounts an approach from start to finish and points out warning signs: vague repository and user names, generic company details, and a recent commit from an unfamiliar author that touched nearly every file in an existing project.

The middle section follows the infection chain. Malicious code is hidden through obfuscation or fetched at runtime from attacker-controlled endpoints, sometimes disguised with error handlers or public JSON hosting. A JavaScript loader runs when the project starts under Node.js, targets browser extensions for crypto wallets, and launches a Python process chosen by operating system. The Python scripts are wrapped in many layers of Base64 and other encodings, sometimes dozens deep. Modules cover keylogging, clipboard capture, credential and card theft from Chromium-based browsers, a configurable file stealer, a backdoor, and a cryptominer for Monero and Ethereum that backs off when a full-screen application is running.

The presenter links the activity to the Lazarus group and its subgroup APT38, tied to the Contagious Interview campaign. The operators keep changing tactics, moving to live interviews, npm packages, Visual Studio Code extensions and AI-assisted malware development. The practical advice is to treat unexpected coding tests with suspicion, verify recruiters through official company channels, and run unfamiliar code only in isolated environments.