Software Engineer Unmasks Cryptocurrency Theft Scheme Disguised as Job Interview

Appaji, a software engineer at Infinite Reality and former intern at Arista Networks, has exposed a sophisticated malware campaign disguised as a technical interview task for a remote Python developer position. The attackers posed as recruiters for a purported Y Combinator-backed startup, offering a high-salary contract role with monthly payments ranging from $10,000 to $15,000. The campaign utilised a cloned public repository to lend legitimacy to the distribution, embedding malicious code within what appeared to be a standard take-home assignment.

The recruitment process began with a direct message on LinkedIn, where the recruiter bypassed conventional hiring protocols by disclosing salary expectations and company affiliation before any initial interview. Appaji, a Computer Science graduate from IIT Patna, noted the unusual transparency but proceeded with caution after verifying the company’s claimed affiliation with a Y Combinator startup. The offer included a Google Drive link containing a zip archive and instructions for a boilerplate FastAPI backend project, which initially appeared clean upon superficial inspection.

Upon closer examination of hidden directories, Appaji discovered pre-configured Git hooks within the repository. These hooks executed a script that checked the victim’s host operating system and silently downloaded a secondary payload from a raw IP address. The initial payload, named tokenlinux.npl, was hidden in the user’s Documents directory as tokenlinux.sh and executed in the background using the nohup utility, ensuring the process continued even after the user disconnected from the terminal.

The secondary payload installed Node.js, configured the system path, and downloaded obfuscated files including parser.js. Analysis of the package.json dependencies revealed the installation of Hardhat, an Ethereum development environment, alongside libraries granting clipboard and file system access. This configuration strongly suggests an intent to locate and drain cryptocurrency wallets or interact with local browser extensions, rather than traditional cryptocurrency mining given Ethereum’s shift away from Proof of Work.

Threat actors employed unique tracking identifiers, passing parameters such as id=402 to serve customised payloads to individual candidates. The original public repository cloned by the attackers was identified as https://github.com/Bgogoi123/personal-finance-service, an innocent FastAPI project repurposed for the campaign. Variations of the attack also involved .vscode folders containing commands that execute upon opening the directory in Visual Studio Code, indicating a broad and adaptable threat infrastructure.