The job interview that infects: fake recruiters, coding tests and pasted fixes
The pattern repeats across years and victims: a plausible recruiter makes contact, a coding test follows, and running the project installs the malware. Kaspersky, Microsoft, ESET and ReversingLabs have all documented variants of it, aimed at defence staff, nuclear-organization employees, crypto developers and ordinary job seekers. The recruitment frame works because it asks the target to do something that looks like work — run a project, join a call, fix a camera error — and because refusal feels expensive for someone who wants the job.
Operation DreamJob: the espionage branch
Kaspersky's December 2024 report describes Lazarus contacting employees through fake recruiter profiles on LinkedIn, Telegram and WhatsApp, offering what looked like skills assessments for IT positions at prominent aerospace and defence companies. The targets — in one case at least two employees of a nuclear-related organization — received ISO archives containing trojanized VNC utilities and were told to connect to an IP address for the supposed test. What ran instead was a staged toolset the researchers track as MISTPEN, CookieTime and the plugin-based downloader CookiePlus, the latter disguised as a Notepad++ plugin. Kaspersky notes this campaign is also referred to as Operation DreamJob.Fake technical interviews for developers
The better-documented branch targets software developers, especially in crypto and Web3. Microsoft's Threat Intelligence team, writing in March 2026, describes the Contagious Interview campaign — active since at least December 2022 — in which attackers pose as recruiters from crypto trading firms or AI solution providers and ask candidates to clone and run an npm package from GitHub, GitLab or Bitbucket. A newer variant abuses Visual Studio Code: opening the repository triggers a prompt to 'trust the repository author', which auto-executes the project's task configuration and fetches the backdoor. ESET tracks the same cluster as DeceptiveDevelopment and documents how the fake interview sites make the camera trick work. The site walks the applicant through a long application form, then asks them to record a video. Camera access is requested but never actually used; instead an error claims the microphone and camera are blocked and offers a helpful 'How to fix' link — which instructs the victim to paste a terminal command that downloads and executes malware. The payload families behind these lures are cross-platform: BeaverTail, a JavaScript infostealer for wallets and browser data; InvisibleFerret, a Python remote-access tool with an AnyDesk module; OtterCookie; and the Go-based WeaselStore, delivered as source code the victim is asked to compile.Coding tests on npm and PyPI
Supply-chain researchers see the same economy from the other side. In February 2026, BleepingComputer reported ReversingLabs' findings on a package set dubbed Graphalgo: 192 malicious npm and PyPI libraries impersonating legitimate 'graph' packages, seeded into otherwise clean coding-challenge repositories on GitHub. The packages stayed benign until a version update added a remote-access trojan, then were deprecated quickly to hide the switch — one example, bigmathutils, had accumulated around 10,000 downloads before its malicious release. The RAT checks for the MetaMask browser extension, exfiltrates files and executes commands from its control server, which ReversingLabs notes is token-protected. The researchers attribute the campaign to Lazarus with medium-to-high confidence, citing commit timestamps in the GMT+9 time zone.'Threat actors simply need to take a legitimate bare-bone project and fix it up with a malicious dependency and it is ready to be served to targets.' — ReversingLabs, via BleepingComputer
The template spreads
It no longer stops at engineers. In July 2026, Team Cymru analyst Will Thomas documented a campaign impersonating more than 30 consumer brands — Adobe, Netflix, Coca-Cola, OpenAI, airlines and hotel groups among them — with fake recruiter emails aimed at marketing professionals. The landing pages ask the applicant to sign in with Google to schedule an interview, then render a convincing fake Google login inside the page — a browser-in-the-browser technique — to capture credentials. The mechanics differ from the malware cases, since here the prize is an account rather than a workstation, but the playbook is the one behind fake tracking-link scams: manufacture a small, plausible obstacle and hand the target a reason to click.Red flags
A few details come up again in nearly every documented case:- A recruiter who pushes to a coding task quickly and provides a repository to run locally, rather than a hosted sandbox or a live pair-programming session.
- An npm or PyPI project whose dependencies you cannot name or vet, or a package that was clean until its latest version.
- An interview site that requests camera or microphone access, reports a blocked device, and offers a 'fix' that involves pasting a command into a terminal.
- An editor prompt to 'trust the author' of a cloned repository, or install steps that end in 'paste this into your shell'.
- A recruiter profile that does not check out against the company's real careers page or a second, independent channel.