🚨Malware Job Interview Scam Targets Devs With Bitbucket Test
Dev job interview? Watch out for malware traps.
TL;DR
A recent job scam involves scammers sending coding tests through Bitbucket, laced with malware. The test includes a TypeScript codebase that can execute remote commands and access files without elevation on Windows and Linux.
Scammers are using LinkedIn to trick developers into downloading malware disguised as legitimate job interview coding challenges. Victims receive an email from a Gmail address asking them to complete a TypeScript project hosted on Bitbucket. The project contains obfuscated JavaScript code that, when executed, connects to a C2 server and downloads additional malicious modules. This scam targets developers by leveraging their trust in common development tools like Bitbucket and TypeScript. It's particularly dangerous because it can run without requiring admin privileges or elevated permissions, allowing the malware to access sensitive files on both Windows and Linux systems. The project includes 180 files with calls to external JSONBin.io endpoints that serve as remote-code execution loaders. The C2 server provides more obfuscated JavaScript code, including modules for file grabbing and clipboard monitoring.
Key Points
The initial contact is made by a non-company LinkedIn user, often from a Gmail address (147.189.174.138).
The TypeScript codebase includes calls to https://api.jsonbin.io endpoints for remote-code execution loading (24,686 chars of obfuscated JS).
Malware modules include scdata, ldata, file grabber, and clipboard monitor, all downloaded from the C2 server.
On Windows, malware uses PowerShell to enumerate drive letters and scan directories without elevation requests.
Precautions: Use AI scans, Docker containers, or isolated systems for testing suspicious code.
Why It Matters
If you're a developer receiving unsolicited job interview coding tests via Bitbucket, be extremely cautious. The malware can run without admin privileges and access sensitive files on both Windows and Linux systems. Developers should use AI scans, Docker containers, or isolated systems to test suspicious code.
Frequently Asked Questions
Why does this matter?
If you're a developer receiving unsolicited job interview coding tests via Bitbucket, be extremely cautious. The malware can run without admin privileges and access sensitive files on both Windows and Linux systems. Developers should use AI scans, Docker containers, or isolated systems to test suspicious code.
What happened?
A recent job scam involves scammers sending coding tests through Bitbucket, laced with malware. The test includes a TypeScript codebase that can execute remote commands and access files without elevation on Windows and Linux.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,267 builders reading daily.