The fake job crypto scam: how a take-home repo drains you

A recruiter messages you on LinkedIn. Senior protocol role, fully remote, $180k–$240k plus tokens, and your on-chain background is "exactly what they need." The process sounds light: clone our repo, run it locally, get the demo working, then hop on a call and walk us through it. Under an hour. You want the job, so you clone the repo and run npm install.

That single command is the entire attack.

There was never a job. The "recruiter" only needed you to run their code once, on the machine where you keep your browser sessions, your SSH keys, and your crypto. The moment the install finishes, a hidden script wakes up, copies those secrets, and quietly ships them to a server you will never see. No password was cracked. No exploit was fired at a contract. You were handed the malware and asked, politely, to launch it yourself.

This is the fake job crypto scam, and it has already cost the industry hundreds of millions of dollars. It works because it targets the one moment when even careful engineers drop their guard: when a great opportunity is on the table and speed feels like the smart move.

TL;DR

• The fake job crypto scam (aka "Contagious Interview") uses a fake recruiter, a take-home coding task, and a repo that runs a stealer the instant you type npm install.
• The payload chain is usually BeaverTail (a JavaScript stealer) pulling down InvisibleFerret (a Python backdoor) — it lifts browser sessions, SSH keys, and wallet files, then beacons out.
• It is not theoretical: the $625M Ronin/Axie Infinity heist in March 2022 started with a fake LinkedIn job and a malicious PDF (BleepingComputer).
• The classic tell is a fast hand-off from LinkedIn to Telegram — it moves you off the platform that keeps a paper trail.
• The one defense that holds: never run interview code on your keys machine. Read package.json first, and if you must run it, use a throwaway VM.

What is a fake job crypto scam?

A fake job crypto scam is a targeted attack where someone posing as a recruiter lures you into running attacker-controlled code on your own computer, usually as a fake "technical screen." The job is bait. The real goal is to get one command — almost always npm install — executed on the machine where your credentials and crypto live.

The pattern is consistent enough that security researchers named it. Palo Alto Networks' Unit 42 tracks it as "Contagious Interview," a campaign it attributes with moderate confidence to a North Korea state-sponsored group (Unit 42). The lure is a staged interview process; the delivery vehicle is a trojanized demo project you are asked to clone and run.

The reason it keeps working is that running a take-home feels completely normal. Engineers clone and run unfamiliar repos every day. The scam simply weaponizes a habit you already have and wraps it in the urgency of a job you want.

How does the npm install actually infect you?

It infects you because npm install runs code, not just downloads it. Node's package manager supports lifecycle scripts — a postinstall hook, for example — that execute automatically the moment installation finishes. You never open the project, never read a line, never hit "run." The malicious line fires on its own.

In the Contagious Interview campaign, that hook drops BeaverTail, a JavaScript-based stealer, which then retrieves its second stage, a cross-platform backdoor Unit 42 named InvisibleFerret (Unit 42). Together they scrape saved browser passwords and sessions, SSH keys, and wallet files, then exfiltrate them. Newer waves also mix in an evolved stealer called OtterCookie.

The scale is not small. In one month after October 2025, researchers at Socket counted 197 malicious npm packages tied to this campaign, pulling more than 31,000 cumulative downloads (The Hacker News). The attackers hide these packages behind names that impersonate popular libraries, so a poisoned dependency deep in the tree can do the same job as an obvious postinstall line. This is a form of phishing aimed at your development environment rather than your login page.

Has this really stolen serious money?

Yes — the single largest crypto theft on record started exactly this way. In March 2022, attackers drained roughly $625 million from the Ronin bridge that powers Axie Infinity. The entry point was not a smart-contract bug. A senior engineer at Sky Mavis was approached on LinkedIn with a generous fake job offer, went through several rounds of "interviews," and received a PDF with the offer details. Opening that document delivered the malware that let attackers compromise the network's validators (BleepingComputer). The FBI later linked the heist to the Lazarus and APT38 groups.

The delivery vehicle changes — a PDF then, an npm repo now — but the play is identical: dress up malware as a career opportunity, and let the target's own ambition do the clicking. When I review a smart contract, the attacker is exploiting a flaw in code. Here, the attacker is exploiting a flaw in human wiring: the urge to move fast on something that looks like a life-changing job.

What is the LinkedIn-to-Telegram tell?

The clearest early warning is a recruiter who rushes you off LinkedIn and onto Telegram. It sounds harmless — "I'm barely on LinkedIn, ping me on Telegram and I'll drop the repo there" — but it is doing real work for the attacker. LinkedIn keeps a record: a real profile, a real company, a message history that can be reported and traced. Telegram does not. Moving the conversation there early strips the paper trail right before the dangerous step, and it lets the "recruiter" send you a raw repo link without the platform ever seeing it.

Legitimate recruiting does the opposite. Real companies keep hiring on channels tied to their identity, schedule through official tooling, and are in no rush for you to run anything before you have even met the team. Treat "let's move to Telegram, here's the repo, run it and ping me the second it's working" as the shape of an attack, not a quirky hiring process. It is the same instinct behind the common crypto scams that push you to act before you think.

How do I run take-home code safely?

You isolate it, or you read it — never run it blind on the machine that holds your keys. Here is the discipline that defuses the whole attack:

• Read package.json first. Look for postinstall, preinstall, or other lifecycle scripts, and scan the dependency list for names you do not recognize. If a "simple demo" ships with install hooks or obscure packages, that is your answer.
• Install without running scripts. npm ci --ignore-scripts fetches dependencies without executing lifecycle hooks, so a postinstall payload never fires.
• Use a throwaway VM. If you genuinely must run an untrusted repo, do it in a disposable virtual machine with no wallets, no saved logins, no SSH keys, and no seed phrase anywhere near it. When you are done, delete the VM.
• Keep a keys machine and a work machine separate. The device that touches your crypto should never be the device that runs strangers' code. This two-machine habit is the single biggest upgrade to your personal security.

None of this slows down a real interview. A legitimate take-home survives you reading the code and sandboxing it. Only the malicious one needs you to run it fast and unread. If you want to feel the decision in real time, the same pressure shows up in the ClickFix attack, where a fake "verification" tries to get you to paste a command — a sibling of this exact trick.

Related questions

Is it safe to do a coding take-home for a job I found on LinkedIn? It can be, but only if you treat the code as untrusted until proven otherwise. Read package.json for install scripts, install with --ignore-scripts, and run anything unfamiliar inside a disposable VM with no wallets or credentials on it. Whether the job is real or fake, the code is the risk — so isolate it either way.

What does npm install actually do that makes it dangerous? It executes code, not just downloads it. Node packages can define lifecycle scripts like postinstall that run automatically the instant installation finishes, before you open or read anything. A malicious repo hides its payload there, so simply installing dependencies runs the attacker's code with your privileges.

Was the Ronin/Axie hack really caused by a fake job? Yes. The roughly $625M Ronin bridge theft in March 2022 began with a fake LinkedIn job offer to a Sky Mavis engineer, delivered as a malicious document during a staged interview (BleepingComputer). It remains the clearest proof that social engineering, not a contract bug, can drain a top protocol.

Why do the scammers push me from LinkedIn to Telegram so quickly? Because Telegram removes the paper trail. LinkedIn ties a message to a profile, a company, and a reportable history; Telegram does not. Moving you there early lets the attacker send a raw repo link and pressure you to run it with nothing recording the dangerous step. A fast hand-off to Telegram is one of the most reliable tells.

What malware gets installed in a fake job crypto scam? Usually a chain of BeaverTail, a JavaScript stealer that grabs browser data and wallet files, and InvisibleFerret, a cross-platform backdoor it pulls down as a second stage (Unit 42). Recent waves also deploy an evolved stealer called OtterCookie. All aim at the same targets: credentials, keys, and crypto.

Where to go next

The fake job crypto scam is not clever code. It is a career opportunity used as a delivery truck for malware, and it collapses the instant you refuse to run unread code on the machine that holds your keys. Read the package.json, install with scripts off, and sandbox anything you do not trust.

The fastest way to lock in that reflex is to feel the pressure yourself. The fake-recruiter drill in the academy's Human Layer track drops you into the exact LinkedIn-to-Telegram thread above and lets you make the call — safely, with nothing real on the line. And to see how this scam fits the broader pattern, read How Web3 users actually get hacked. Start the drill below.