The take-home interview test that hires your laptop instead of you
If anyone in your business writes code, or is quietly looking for their next job, this one is for them. A developer this week published a walkthrough of a take-home interview test he received from a LinkedIn recruiter. The project compiled, the brief looked professional, the pay was generous, and the company checked out as a real Y Combinator startup. The malware was hidden where almost nobody looks: in the project's git hooks, set to run the moment he used git, exactly as the interview tasks instructed him to.
How the trap worked
The approach was ordinary. A recruiter message on LinkedIn, a plausible role, a salary of $10,000 to $15,000 a month, then a take-home assignment delivered as a zip file with a PDF of tasks. The code inside was a standard Python web backend, and the dependency list was clean. Nothing a routine check would flag.
The payload sat in .git/hooks, the folder of scripts git runs automatically around normal commands. The pre-commit hook detected the operating system, silently fetched a script from a remote server, and ran it in the background. The assignment's tasks included git operations, so a diligent candidate would trigger it within minutes of starting work. From there, a second stage installed Node.js, pulled down an obfuscated payload, and ran it invisibly. The dependency list of that payload included clipboard access and an Ethereum development toolkit, which points firmly at stealing credentials and draining cryptocurrency wallets.
Two details are worth pausing on. First, the attackers used a real company's name without its knowledge, and cloned an innocent developer's public repository as the disguise. Both the "employer" and the codebase were real things an inspection would validate. Second, other candidates received a variant that hid the trigger in a .vscode folder instead, configured to run as soon as the project was opened in the editor. That version needs no git command at all. Opening the folder is enough.
This shape of attack has a history. Security researchers at Palo Alto Networks have tracked fake-recruiter campaigns targeting job seekers since 2023, attributing them to North Korean state actors who use malicious coding tests to steal credentials and cryptocurrency. The playbook is now well established, and it works because it targets people at their most receptive: mid-interview, keen to impress, running a stranger's code because that is literally the task.
Why this is a business problem, not just a personal one
The obvious victim is the candidate. But the machine that gets infected is very often a work laptop, and the browser on it holds work sessions, saved passwords, and access to your systems. Three scenarios put this on your desk:
Your staff are job hunting on work machines. Some of them are, whether you like it or not. A developer who runs a take-home test on their work laptop has just run unaudited code from a stranger inside your network, with their logged-in sessions alongside it.
You hire developers or contractors. The same social channel runs in reverse. Fake candidates, fake portfolios, and shared "sample projects" flow towards your hiring managers, and the person reviewing a submitted coding test faces exactly the same risk as the candidate in this story.
Your agency or freelancers touch client code. If you build software for clients, one infected contractor laptop is a route into every repository and credential they can reach.
What to do
The defence costs almost nothing and fits on a page.
Make "untrusted code runs in a sandbox" a stated rule. Interview tests, sample projects, and code from unknown parties get opened in a throwaway virtual machine or a disposable cloud environment, never on the main machine. For anyone technical this is a five-minute habit. The developer in this story only escaped because he checked hidden folders first; a sandbox removes the need for luck.
Tell your team about the trigger points. Git hooks fire on normal git commands. Editor task configurations can fire on simply opening a folder. "I did not run anything" is no longer a safe assumption, and a candidate who knows that will look, or sandbox, before opening the gift.
Treat inbound recruitment as phishing. Too-generous pay revealed upfront, urgency, and a zip file from a Google Drive link are the same red flags as any phishing email, dressed for LinkedIn. A one-line addition to your security awareness material covers it: recruiters do not send zip files, and interview tasks are code you inspect in a sandbox, not code you trust.
If someone has already run one, treat the machine as compromised. Passwords and sessions that browser held should be reset from a different device, and any cryptocurrency wallets moved. Then look at what else that machine could reach.
How Steelwise can help
Working out what an infected laptop in your business could actually reach, and putting cheap guardrails in front of it, is the kind of review we do. Get in touch.