一场大规模招聘诈骗活动利用虚假的Python开发职位向求职者投放恶意代码。[1]
根据安全研究人员的发现，诈骗者通过LinkedIn直聘消息发送招聘机会，声称月薪为$10,000-$15,000。[1]在招聘流程中，应聘者被要求完成一份take-home面试项目，该项目的Git仓库中隐藏着恶意脚本。[1]
这些隐藏的Git hooks会自动执行远程代码，从IP地址45.61.164.38:5777服务器下载并执行多阶段payload。[1]每个payload包含追踪参数id=402，用于区分受害者。[1]
第二阶段的恶意代码下载了Ethereum开发工具Hardhat及钱包访问库clipboardy，旨在窃取加密钱包。[1]此外，这些payload还能执行系统级操作。[1]
诈骗者冒用真实Y Combinator创业公司Zavopay的名义实施欺骗。[1]原始的面试项目是从GitHub克隆的真实FastAPI个人财务管理应用程序，经过植入恶意代码后用于钓鱼。[1]攻击者通过在.vscode文件夹配置launch命令或Git hooks两种方式触发感染。[1]
A software developer uncovered an elaborate recruitment scam involving malicious code embedded in a take-home interview project. [1] The fraudulent operation used a fake job posting claiming to offer a Python development position paying $10,000–$15,000 per month, distributed through LinkedIn direct messages. [1]
Upon inspecting the project files, the researcher discovered hidden Git hooks containing malicious scripts designed to download and execute multi-stage payloads from a remote server at IP address 45.61.164.38:5777. [1] The attack was triggered through either .vscode folder configurations or Git hooks, and included a tracking parameter (id=402) to identify individual victims. [1]
The second-stage payload installed Ethereum development tools and cryptocurrency wallet access libraries, including Hardhat and clipboardy, indicating the attackers' focus on stealing digital assets. [1] The scammers had impersonated Zavopay, a legitimate Y Combinator-backed startup, to lend credibility to the fraudulent recruiting effort. [1] The underlying project itself was cloned from a genuine FastAPI-based personal finance application available on GitHub. [1]
This incident represents a broader recruitment scam targeting software developers globally, combining social engineering with supply chain exploitation to distribute information-stealing malware. [1]