Appaji - Software Engineer

Core View

The scam began with a LinkedIn outreach offering a remote Python developer role with an unusually high monthly salary ( $10, 000 -$ 15,000), leveraging the prestige of a Y Combinator startup to establish fake legitimacy.
The attack vector involved a take-home assignment delivered via a Google Drive zip archive containing a cloned FastAPI project.
Malware was embedded in the .git/hooks/pre-commit script, which detected the host OS (macOS, Linux, Windows) and executed a remote payload from a raw IP address.
The multi-stage payload installed Node.js and executed an obfuscated parser.js script. The associated package.json included hardhat (an Ethereum development environment) and clipboardy, strongly suggesting the intent was to drain crypto wallets or steal sensitive clipboard data.
Other variants of this campaign use .vscode folder launch commands to infect users simply by opening the directory in VS Code, bypassing the need to run Git commands.

Recruitment scams often use high-pay lures and legitimate-looking technical assessments to deliver malware.
Developers should always inspect hidden directories (e.g., .git/hooks, .vscode) using tree -a before running code from unknown sources.
The use of hardhat in a non-blockchain-related job assessment is a critical red flag for crypto-stealing malware.
Attackers may clone random public repositories to make their malicious project folders appear authentic.

Topics: Career, Tech
Tags: career malware cybersecurity