A recruiter slid into a Python developer's LinkedIn DMs with a remote contract-to-hire role: 0,000 to 5,000 a month, a supposed Y Combinator startup, pay disclosed suspiciously early. Wary but curious, the candidate accepted the take-home assignment.
The zip arrived with a boilerplate FastAPI project, a PDF of "codebase improvements and git operations" — and, tucked into .git/hooks, a pre-commit script that checked the host operating system and piped a payload from a raw IP address straight into sh. On Windows, a cmd equivalent. The chain installed Node, fetched an obfuscated parser, and ran it with nohup. The dependencies told the story: hardhat, clipboardy, basic-ftp, jsonwebtoken. A per-victim id parameter returned a different, customized payload when changed.
The attack was not isolated. Some candidates received a .vscode folder with malicious launch commands — opening the directory in VS Code was enough to get infected. Git history showed the project was cloned from an innocent public repo. The company name was just bait.
The recruiter deleted the account when called out. The candidate published the full analysis. "Why use a raw IP address? If anything, this screams malware."