Fake coding interview malware: how a take-home test can hack a developer's laptop, and how to run one safely

If a recruiter asks you to clone a repository, run a take-home project or install a "video interview" app on your own laptop, stop and check before you run anything. That request is how the campaign security researchers call "Contagious Interview" infects developers, and its malware steals saved browser passwords, crypto wallets, keys and work access (Unit 42, 2023; FBI and partners, 2026).

You do not have to refuse every coding test. You have to stop running strangers' code on the machine that holds your money and your employer's secrets.

Key takeaways

• A fake recruiter's coding test, "bug fix" or video-call app can install malware the moment you run npm install, npm run dev or open the folder in VS Code.
• The malicious code is often hidden in places you skim: a config file, a dependency, a VS Code task, or one line pushed far off-screen.
• Never run an unknown repo on the laptop with your crypto wallet, password manager, SSH keys or work logins. Use a throwaway virtual machine, Codespace or container.
• Read package.json scripts, config files and .vscode/tasks.json before running anything, with word wrap on.
• If you already ran it: disconnect, change passwords from a clean device, revoke tokens and SSH keys, move crypto to a new wallet, tell your employer, and report it.

What is the fake coding interview malware scam?

It is a long-running campaign in which attackers pose as recruiters or hiring managers and get software developers to run malicious code as part of a "technical interview". Palo Alto Networks' Unit 42 named it Contagious Interview in November 2023 and attributed it, with moderate confidence, to a North Korean state-sponsored actor (Unit 42, 2023). Other researchers track the same activity under different names: DeceptiveDevelopment at ESET (ESET, 2025), UNC5342 at Google (Google Threat Intelligence Group, 2025), Famous Chollima in Socket's reporting (Socket, 2026), and WaterPlum in a 2026 joint government advisory.

It is not small, and it is not over. Microsoft says the campaign has been active since at least December 2022 and was still showing up in its customers' environments (as of March 2026) (Microsoft, 2026). In September 2026, police and security agencies from Japan, the US, Australia and Germany said the group had infected at least 30,000 computers in more than 100 countries between December 2025 and July 2026, and taken funds or credentials from over 7,000 crypto wallets, moving at least 1.7 billion yen (US$10.71 million) of crypto to North Korea (as of September 2026) (FBI and partners, 2026).

How does a fake job interview hack a developer's laptop?

The process copies a real hiring pipeline: outreach, technical discussions, an assignment and follow-ups (Microsoft, 2026).

1. The approach. Fake recruiters build convincing profiles on LinkedIn and job boards, often impersonating well-known tech or crypto firms, then move the chat to Telegram or Discord (Google Threat Intelligence Group, 2025). ESET also saw fake listings on Upwork, Freelancer.com, We Work Remotely and Crypto Jobs List (ESET, 2025).
2. The interview. The role is usually at an AI, crypto or NFT company (FBI and partners, 2026). The conversation feels normal.
3. The task. You are asked to clone a project from GitHub, GitLab or Bitbucket and run it (Microsoft, 2026), or to fix a bug or add a feature (ESET, 2025). Other versions use a fake video-interview site that shows an error and asks you to download a "fix" (Google Threat Intelligence Group, 2025) or paste a command (Microsoft, 2026), or a fake video-call app such as "MiroTalk" (Unit 42, 2024).
4. The hidden loader runs. A malicious npm dependency, a poisoned config file or a VS Code task starts quietly in the background when you install, start or open the project.
5. The next stage arrives. The loader downloads more malware from the attacker's server, or, in newer versions, from data stored on a public blockchain.
6. The theft. Passwords, wallets, keys and files leave your machine, and a backdoor can keep the attacker inside.

Step three is the only one you control. Pattern drawn from Unit 42, Microsoft, Google and the 2026 joint advisory; real cases skip or repeat steps.

A first message might look like this (illustrative, written for this guide):

Hi Rahul, I'm hiring for a Senior Full-Stack Engineer (remote, US$90k-120k) at a Web3 trading start-up. Your Node.js profile is a great fit. Our first round is a short practical task: clone this Bitbucket repo, run npm install and npm run dev, fix the wallet-connect bug and share a screen recording by tomorrow. Happy to continue on Telegram.

No single line is outlandish. The mix of an unexpected, well-paid crypto role, a deadline and "just run it locally" is the pattern.

What does the malware steal?

Everything a developer's laptop holds. The early families were BeaverTail, a JavaScript stealer and loader, and InvisibleFerret, a Python backdoor that can log keystrokes and install the AnyDesk remote-access tool (Unit 42, 2023). Microsoft now sees OtterCookie, a modular JavaScript backdoor, most often (Microsoft, 2026).

Across these reports, the targets include:

• Saved browser passwords, session cookies and saved cards in Chrome and Edge (Google Threat Intelligence Group, 2025).
• Crypto wallet extensions such as MetaMask, Phantom and Coinbase Wallet (Unit 42, 2024), plus seed phrases and private keys (FBI and partners, 2026).
• Password manager data, including 1Password and KeePass artefacts (Microsoft, 2026).
• .env files, API tokens, cloud credentials, signing keys and source code (Microsoft, 2026).
• Keystrokes, clipboard contents, screenshots, and scanned ID documents such as a passport or driving licence (FBI and partners, 2026).

The damage can go beyond you. The agencies warn that stolen credentials can be used against your employer and clients, and that stolen ID images can be used by North Korean IT workers to impersonate victims (FBI and partners, 2026). If you write code for an Indian IT services firm or a GCC, your laptop may hold access to a client's systems too.

Are developers in India targeted?

Assume yes. ESET says the attackers "don't distinguish based on geographical location" (ESET, 2025), and the joint advisory counts victims in more than 100 countries (as of September 2026) (FBI and partners, 2026). None of the public reports we found gives a count for India.

The lures arrive where many Indian developers look for remote and freelance work: LinkedIn, Upwork, Freelancer.com, crypto job boards and Telegram groups. And the roles on offer, remote, paid in dollars, in Web3 or AI, are what many engineers in Bengaluru, Pune and Hyderabad are hoping for.

Unlike the WhatsApp "task" job scams, nobody asks you for money here; they want you to run something. For offers that ask for a registration or training fee, see our guide to fake job offers in India.

How do I spot a fake recruiter or a malicious take-home?

The FBI's warning list for this kind of social engineering is a good start (FBI, 2024):

• An unexpected offer from a prominent crypto or tech firm, with unusually high pay and no negotiation.
• A "pre-employment test" or debugging exercise that means running unknown Node.js or Python packages, scripts or GitHub repositories.
• Pressure to use non-standard or custom software for a simple task.
• Requests to run code or install apps on a company laptop.

Microsoft adds: short links that redirect to file hosts, newly created repositories or accounts, overly complex setup steps, and requests to disable security controls or "trust" an unknown author (Microsoft, 2026). Treat any "paste this command to fix your camera" instruction as high risk.

Two more checks from our side. The role should appear on the company's own careers page, and the recruiter should be willing to email you from the company's domain. And be wary when the task is mostly "run this large, pre-built app" rather than "write some code". A short reply keeps you safe without burning the bridge:

Thanks, happy to do the task. My policy is to run interview code only in a cloud sandbox, so I'll open it in a GitHub Codespace. Could you also send the job link from your company's careers page and continue over your work email?

A genuine recruiter has no reason to object. Pushback or silence tells you something.

Where can malicious code hide in a coding test repo?

In places reviewers skim. ESET found attackers appending malicious code "as a single line behind a long comment", which pushes it off-screen; you see it only if you scroll right or turn on word wrap, and GitHub's code view does not wrap by default (ESET, 2025).

In May 2026 Socket found the same trick in a config file. An otherwise normal tailwind.js had obfuscated JavaScript "hidden far to the right after a large whitespace gap" after the closing }; (Socket, 2026). JavaScript config files are code: when a build tool loads one, during a dev server start or a build, everything in it runs.

An illustration with placeholder text, not real malware. The pattern follows ESET (2025) and Socket (2026).

Other hiding places researchers have documented:

• npm packages. Socket identified more than 338 malicious npm packages with over 50,000 downloads in one wave (as of October 2025), many of them typosquats of everyday packages like express, dotenv and ethers that run at install or import (Socket, 2025).
• VS Code tasks. A .vscode/tasks.json set to run when the folder opens executes as soon as you click "Yes, I trust the authors" (Microsoft, 2026).
• Trojanised library files and .env values. Microsoft found a modified jquery.min.js that ran on npm run dev, and a base64-encoded address in .env that, at server startup, received the server's environment variables and sent back code to run (Microsoft, 2026).
• The blockchain. In "EtherHiding", the loader fetches its next stage from a smart contract on BNB Smart Chain or Ethereum, so there is no server to take down. Google saw one such contract updated more than 20 times in four months, at an average of US$1.37 per update (as of October 2025) (Google Threat Intelligence Group, 2025).

How do I safely run a take-home coding assignment?

Socket's advice is to treat unfamiliar build instructions "as code execution events" during interviews (Socket, 2026). The joint advisory says to run unknown code only in a sandbox or virtual machine, after checking it for obfuscated or unreadable sections (FBI and partners, 2026).

The 10-minute check, before you run any take-home:

1. Confirm the recruiter and the role through the company's own website.
2. Open the repo in your browser or a plain text editor, not your usual IDE.
3. Read every script in package.json, especially preinstall, postinstall, prepare, dev and start.
4. List the dependencies and look for misspelled names or packages you have never heard of.
5. Open every config file: next.config., vite.config., tailwind.config., postcss.config., webpack.*.
6. Turn on word wrap and look for very long lines or code after the last closing bracket.
7. Search the repo for eval, new Function, child_process, base64, curl and long encoded strings.
8. Open .vscode/tasks.json, or open the folder in Restricted Mode by answering "No" to the trust prompt.
9. Keep wallets, password managers, SSH keys, cloud logins and work accounts off the machine you will use.
10. Run the project only in a throwaway VM, GitHub Codespace or container.

Screenshot this before your next take-home. Based on guidance from the 2026 joint advisory, Microsoft, Socket and the FBI.

Steps 9 and 10 matter most: a review can miss something, but a sandbox with nothing worth stealing makes a miss cheap. No VM? A spare laptop with no personal or work accounts is the next best thing. And never use a company laptop, as the FBI advises (FBI, 2024).

I already ran the code. What should I do now?

Act now and assume the worst: even after malware is removed, the joint advisory says to assume data, including wallet information, has already been taken (FBI and partners, 2026). In order:

1. Disconnect the laptop from the internet (Wi-Fi off, cable out) to cut the attacker's connection (FBI and partners, 2026).
2. Move your crypto first. Create a new wallet on a separate, clean device, transfer everything to it, and store the new seed phrase offline (FBI and partners, 2026).
3. Change passwords from a clean device, starting with email, banking and UPI apps, your password manager, GitHub and cloud accounts. Sign out of all other sessions.
4. Revoke what the laptop held: GitHub and npm tokens, SSH keys, API keys, cloud access keys and anything in a .env file. Microsoft's advice is to rotate exposed credentials and review repository and CI/CD access (Microsoft, 2026).
5. Tell your employer's security or IT team today if the machine ever had work access. Stolen credentials can be used against your employer and its clients (FBI and partners, 2026); early warning helps them contain it.
6. Back up only your own files, then reset the operating system fully, because hidden malware may remain (FBI and partners, 2026).
7. Report it. File a complaint at cybercrime.gov.in; if you have lost money, call 1930 first, then complete the complaint on the portal within 24 hours using the acknowledgement number you receive by SMS (I4C FAQ). You can also report the incident to CERT-In at [email protected] or toll-free on 1800-11-4949 (CERT-In).
8. Report the profile and the repo. Report the fake recruiter on LinkedIn or the job site, and the repository to GitHub, GitLab or Bitbucket, so the next person is spared.

Keep the evidence (chat screenshots, the recruiter's profile link, the repo URL, the commands you ran) and do not delete the chat before you report it.

Frequently asked questions

Is every take-home coding assignment a scam?

No. Many real companies use take-homes. The risk is running someone else's code on your main machine, so do the work in a Codespace or VM, and treat an objection to that as a warning sign.

I only ran npm install. Am I safe?

Not necessarily. npm packages can run scripts at install time, and Socket found loaders that execute at install or import (Socket, 2025). If the repo came from an unverified recruiter, follow the steps above.

Will antivirus catch it?

Sometimes, but do not rely on it. These loaders are obfuscated, often run in memory (Microsoft, 2026), and can fetch a fresh payload from a blockchain (Google Threat Intelligence Group, 2025). Keep antivirus on, and use a sandbox anyway.

Is opening the folder in VS Code safe if I don't run anything?

Only in Restricted Mode. Answer "No" to "Do you trust the authors of the files in this folder?", so tasks set to run on folder open cannot start (FBI and partners, 2026).

I'm a fresher with no crypto. Why would they target me?

Your passwords, email, GitHub account and ID documents are still worth stealing. The advisory says the attackers target IT professionals broadly, including web freelancers (FBI and partners, 2026).

Look for work where you can verify it

Keep job hunting; just keep the hunt and your secrets on separate machines. If you want leads you can check yourself, HiringAnt's AI Job Search finds real jobs that match your resume: it is free, and you can try it with no account.

Sources

1. Palo Alto Networks Unit 42, "Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors", 21 November 2023
2. Palo Alto Networks Unit 42, "Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware", 9 October 2024
3. Microsoft Threat Intelligence, "Contagious Interview: Malware delivered through fake developer job interviews", 11 March 2026
4. Microsoft Threat Intelligence, "Developer-targeting campaign using malicious Next.js repositories", 24 February 2026
5. Google Threat Intelligence Group, "DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains", October 2025
6. ESET Research, "DeceptiveDevelopment targets freelance developers", 20 February 2025
7. Socket, "North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads", 10 October 2025
8. Socket, "Famous Chollima Targets PHP Developers Through Compromised Packagist Package", 31 May 2026
9. FBI, Public Service Announcement I-090324-PSA, "North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks", 3 September 2024
10. National Police Agency of Japan, National Cybersecurity Office of Japan, FBI, DC3, ASD's ACSC, BND and BfV, joint advisory on North Korean "WaterPlum" ("Contagious Interview"), 18 September 2026
11. Indian Cybercrime Coordination Centre, Ministry of Home Affairs, Frequently Asked Questions
12. CERT-In, Contact Us (Incident Response Help Desk)