Mateable MTBC

Fun story: North Korean hackers just tried to steal my crypto & hack my PC with a fake LinkedIn job interview. @780thC @DC3Forensics @FBI @NSACyber @CISAgov @US_CYBERCOM The North Koreans are using @vercel @Google @github & @cursor_ai to scam developers through fake @LinkedIn recruiters. The sophistication was genuinely impressive, right up until a bald dude who barely spoke English showed up on screen to "interview" me for a consulting gig and tried to get me to run a sketchy gambling app. If you're in crypto, AI or Tech: BEWARE fake recruiters and "take-home" coding tasks on LinkedIn. Here's exactly how it played out. 1) A good-looking blonde "British woman" based in London messaged me on LinkedIn. Perfect English, clean grammar, legit-looking profile. Recruiting for a new role / part-time consulting gig. 2) She set up a Google Meet to discuss more, very professional & clean grammar/ english. 3) I get on the call and… it's not the blonde recruiter. It's a bald Chinese looking dude who could barely speak English, complaining about a "bad internet connection," who immediately turned his camera off, looked nervous. 4) He sends over a Figma mockup of a blockchain gaming app they supposedly want to build. Looks like a real product spec. Gambling of course. Sports betting, roulette a combination of "Crypto staking" & "gaming"... much innovation... such wow. (Figma link only opened in isolated brave browser) 5) Everything was believable — until the questions got weird. "What wallets do you use?" "What AI code editor do you use?" 🚩 I respond, I don't use web wallets in a browser, they have a giant attack surface. I asked: "is your app in web browser connected to a web wallet?" ... I hear a groan and stutter. 6) Then he asks: clone this GitHub repo, run `npm install`, and open it in Cursor. He was oddly insistent about the editor. At first glance the code looked like a simple JS app. I said I don't have cursor. He said install Cursor, I said no. 7) I cloned & ran it in an isolated vscode terminal, which he insisted I do on screen, I ran for a second, it loaded in an isolated brave browser within seconds my gut screamed something was wrong & I Killed it. 8) I told them it would not run (isolated brave browser, their code would not run) "Oh, the code won't run on your end? Just open this link where our web app is " I decided to play along knowing damn well it was a scam at this point it in an isolated browser. 9) A slick app loads with a roulette wheel— hosted on Vercel — with a big "Connect Wallet" button. I click it. A fake MetaMask window pops up. 10) He says: "just connect MetaMask, use your password" Sure, buddy. I type in the password: **FuckYou**... as I hear Korean in the the background. 12) He suddenly has to "jump on another call." Hangs up. Deletes the LinkedIn profile within minutes. Poof. Gone. 12) So I tore the code apart. It was 100% malware — purpose-built to steal crypto and credentials. — What the code actually did: Buried in one file (`server/routes/api/auth.js`), hidden off-screen behind a wall of whitespace, was an obfuscated payload rigged to auto-run the moment you `npm install`. It: • fingerprinted my machine and possiblely shipped my entire environment to a North Korean command-and-control server, • then possibly ran whatever code that server sent back via `eval()` — full remote code execution, the hook used to drop a crypto-wallet stealer, • and re-checked in every 5 seconds. The code even auto-executed via an npm "prepare" hook — so just installing dependencies fires it. No "run" required. This is apparently a known DPRK campaign researchers call "Contagious Interview" (aka Famous Chollima). The fake recruiter, the Figma, the "use this editor," the take-home repo — it's a script, and they run it on developers (especially in crypto) at scale. I did not lose any crypto, as I have said for years storing crypto in a web wallet is a recipe for disaster and I refuse to do it, MetaMask should never be used. After multiple forensic audits, I do not see any evidence anything was retrieved from my machine, but none the less I am still changing every credential located on this computer. Then wiping it. Fortunately I did not have much of anything on this pc anyways. — What gave it away: • Recruiter on camera ≠ recruiter who messaged me • Camera "broken," English fell apart on the call • Sudden, specific wallet + editor questions • Pressure to clone/run code and "just connect your wallet" • The profile vanishing the second I didn't bite Lessons: • A "coding interview" that needs you to run their repo on your machine is malware until proven otherwise. • Never `npm install` untrusted code on a machine that holds anything valuable. Use a throwaway VM. • Keep serious crypto in cold storage / hardware — a hot wallet in your browser on your daily driver is a target. • If a recruiter's story doesn't survive a single video call in first 30 seconds, walk. - Never do an interview on a computer that holds crypto or any sensitive data. I now have a full forensic report; the malware, the deobfuscated payload, the C2 server IP, the whole metadata trail and it's going to the FBI. Stay paranoid out there. 🫡 And Fuck You Lazarus, you North Korean Pricks!