Malware Distribution via Fake Job Interviews and Git Hooks

Malware Distribution via Fake Job Interviews and Git Hooks

Executive Summary

Fake job interviews are being used as a delivery vector for sophisticated malware targeting software engineers. Attackers use social engineering on LinkedIn to lure candidates into downloading "take-home assignments" that contain hidden malicious configurations in .git/hooks or .vscode folders, allowing for remote code execution (RCE) and potential theft of cryptocurrency assets.

The Attack Vector: Social Engineering

The campaign begins with a highly targeted approach on LinkedIn. Recruiters offer remote-first, high-paying roles (e.g., $10,000–$15,000 per month) to attract candidates. To establish legitimacy, attackers often impersonate real companies or Y Combinator startups.

Once a candidate is engaged, they are sent a Google Drive link containing a ZIP archive. This archive typically contains a legitimate-looking project—often a cloned public repository (e.g., a FastAPI backend)—to avoid detection by basic static analysis of the source code.

Technical Analysis of the Malware

Stage 1: The Git Hook Trigger

The primary infection vector is the use of pre-configured Git hooks. By including a .git folder in the ZIP archive, attackers can embed scripts that execute automatically during standard Git operations.

In one analyzed case, the pre-commit hook contained a shell script that detected the victim's operating system (macOS, Linux, or Windows) and used curl or wget to fetch a remote payload from a raw IP address (45.61.164.38).

Stage 2: Payload Delivery and Persistence

The initial script downloads a secondary payload (e.g., tokenlinux.sh) and moves it to a hidden location, such as the ~/Documents directory. It then uses the nohup command to ensure the process continues running in the background even after the terminal is closed.

Stage 3: Environment Setup and Obfuscated Execution

The second-stage script performs the following actions:

  1. Dependency Installation: It installs Node.js and the npm package manager.
  2. Payload Retrieval: It downloads a package.json and a heavily obfuscated parser.js file.
  3. Execution: It runs the parser.js script in the background.

Analysis of the package.json reveals suspicious dependencies, including clipboardy (for clipboard access) and hardhat (an Ethereum development environment), suggesting the malware's goal is to locate and drain cryptocurrency wallets or steal sensitive tokens from the user's clipboard.

Alternative Infection Methods

Beyond Git hooks, attackers have employed other methods to trigger execution:

  • VSCode Launch Configurations: Some versions of the attack include a .vscode folder with configurations that execute commands automatically as soon as the directory is opened in Visual Studio Code.
  • Targeted Social Engineering: Some developers report highly specific attacks where a "CTO" conducts a fake screening interview before asking the candidate to clone a malicious repository.

Community Insights and Attributions

Industry observers and affected developers have noted several patterns regarding this campaign:

  • State-Sponsorship: Multiple reports suggest this is a North Korean (DPRK) APT campaign, characterized by the use of .npl file extensions and targeted attacks against maintainers of popular open-source packages.
  • AI Tooling Limitations: Some users found that AI safety rails (specifically in Claude) prevented the analysis of the obfuscated malware, while other models like Gemini were able to provide breakdowns.
  • Platform Vulnerabilities: There is significant criticism of LinkedIn's lack of recruiter verification, which allows attackers to easily impersonate corporate entities.

"I think it was a targeted attack because in the past I maintained a very popular NPM package with 43+M weekly downloads. That's my only explanation for why someone would carry out such a sophisticated social-engineering attack against me."

Prevention and Mitigation

To protect against these types of attacks, developers should adopt the following security practices:

  • Inspect Hidden Directories: Always run tree -a or similar commands to check for unexpected .git/hooks or .vscode folders in third-party projects.
  • Use Isolated Environments: Never run take-home assignments or third-party code directly on a host machine. Use a dedicated Virtual Machine (VM) or a Docker sandbox.
  • Verify Recruiters: Validate the identity of recruiters by contacting the company through official channels or verifying their email domain before downloading any files.
  • Avoid Cloning Unknown Repos: Be wary of requests to clone and run repositories from unverified sources, especially if the offer seems "too good to be true."

Sources