Fake Job Interview Malware: A 2026 Playbook for HR, Managers and the SOC

Keep interview and take-home code off work laptops. That one rule breaks the chain that Binance described, and it costs nothing in licenses. Where a candidate's code really has to run, a disposable GitHub Codespace runs from $0.18 an hour on its 2-core machine, per GitHub's billing docs, read on 4 November 2026. This playbook sets out what HR, engineering managers and the SOC each do.

Binance says its security team detected and prevented 57 suspected North Korea-linked cyber threat cases in 2026. One of its software engineers was lured through a fake interview that ended with a code repository to set up on his work computer. The interview was the delivery method. The setup step was the payload.

Cyberpresso data: as of 4 November 2026, 4 of Cyberpresso's 256 news posts since 18 August 2026 covered campaigns that reached victims through a fake recruiter or job test: Mirage Kitten (2 September), the Contagious Interview campaign, which uses a fake job interview as its pretext and here shipped fake macOS installers (6 September), WaterPlum in Japan (23 September) and the Dubai Airports coding test (8 October). A fifth post covers the reverse, fake hires, in the DOJ laptop-farm raids (15 October). Binance's own account of its engineer's interview came on 3 November, after our 31 October news post. Method: every news post in the archive was searched for recruiter, interview and job-test lures, and each match was read.

The controls at a glance

What happened to Binance's engineer, step by step

Binance's account lays out the sequence in order, and the order matters for the controls below.

• Contact. A person posing as a "Project Director" reached Software Engineer B through a legitimate job-hunting platform. The engineer's profile mentioned his Binance experience.
• First interview. A purported HR representative ran a live video interview and shared a social media account with personal photos and videos to build trust. Binance calls this "more advanced and deceptive than previously seen" social engineering.
• Second interview. It took place in a popular social chat app. Near the end, the engineer was told to download an "assignment", a code repository, onto his work computer.
• Setup. Malicious code ran during the repository's setup process. Binance says it swapped a legitimate development tool component for a malicious version that reached an attacker-controlled server. Its post lists the file operations: a valid pyenv under /opt/homebrew/Cellar/pyenv/2.8.0/libexec was deleted, a modified copy was renamed into its place, /opt/homebrew/bin/pyenv was removed, and a new symlink was created before zsh was spawned.

Binance says the 0-day malware "was not detected by the endpoint security protection tools at the time". That gap is why the SOC section below ends with a limit, not a promise.

The engineer's machine was not the end of the chain. Binance says the attacker used the compromised computer and an internal AI tool to take control of two more wallet engineers on 20 October. On 29 October, it says, the attacker used credentials stolen from one of them to log onto another engineer's computer, deploy a container and start the attack on wallet signing operations. Binance also describes an earlier engineer who downloaded a tampered Homebrew installation after searching for an AI coding tool, and says its security team detected that anomaly and replaced the device.

Binance's post describes no phishing link. The engineer ran a repository he had been asked to download during an interview. Binance says the FBI attributes the incident to North Korea, and quotes the FBI's latest information as indicating that "the Democratic People's Republic of Korea is responsible". Our 31 October report covered the incident before Binance's own account came out.

HR and talent teams: verify the approach, not the video

The fake recruiter approaches the company's own employees as job candidates, and the Binance case shows that first contact can look legitimate: a real job platform, a named company and a live video call. A video call shows that someone is on camera. It does not show that they work for the company they name.

What the employee does when approached:

• Check through another channel. Confirm the recruiter and the company through the company's official website or a number the employee finds independently, not a number in the message.
• Treat a change of app as a stop sign. Binance's case moved from a job platform to a live video interview and then to a second interview in a popular social chat app. Any request to continue in another app is a reason to pause and check.
• Never open an archive, repository or installer from a recruiter. A written brief is enough for a first-round test.
• Report the approach. Ask staff to report it to the security team with the name, domain and platform, so the SOC can search for the same lure.

These steps cost time. An employee who pauses to check may lose a real opportunity, and a busy team will sometimes skip a check it should have made. Accept that cost, because a paused approach is cheap to recover from.

Engineering managers: take-home work runs in a box

Managers decide what happens after the interview. The rule is short: nobody runs a candidate's code on a company device. A reviewer reads the code in a read-only view, and any task that must run goes into a disposable environment.

GitHub's billing docs price the disposable environment. A 2-core codespace is $0.18 an hour, a 4-core one $0.36 an hour, and storage is $0.07 per GB-month. Each machine draws on the included usage at a multiplier, 2 for 2-core and 4 for 4-core. GitHub Free's 120 included compute hours therefore cover 60 hours on a 2-core machine or 30 on a 4-core one, and GitHub Pro's 180 hours cover 90 hours on 2-core.

A codespace is not a clean room. It keeps the malware off the laptop, but anything signed into it is available to code that runs there. Use a token with no write access to your company repositories, and delete the codespace after the review. Related: our guide to getting secrets off developer laptops.

Two editor settings matter. VS Code's task documentation says the task.allowAutomaticTasks setting controls whether tasks with "runOn": "folderOpen" run when a workspace opens. Its default is off, and automatic tasks never run in an untrusted workspace. Set it explicitly in your user settings:

{
  "task.allowAutomaticTasks": "off"
}

Workspace Trust is the second layer. VS Code opens an unfamiliar folder in Restricted Mode, which disables tasks, terminals and debugging until someone trusts the folder. The same documentation says Workspace Trust cannot stop a malicious extension from running code, so install extensions only from publishers you trust. Our guide to finding malicious editor extensions covers that side.

For npm, the install docs describe an ignore-scripts setting, default false, that stops npm from running the scripts in package.json. Installing with npm install --ignore-scripts skips preinstall, install and postinstall, the hooks a setup step uses to run code. The cost is real. npm's scripts docs say install and preinstall scripts are mainly for compiling native code, so packages that need a build will fail until someone runs that build by hand. Binance does not name the tool that ran its setup, so apply the rule to every package manager your team uses.

Managers also own the people. Engineers who are job hunting are the target, because the lure starts from their profile. Give your team the pattern in one paragraph, and a route to report a recruiter who asked them to run something. Nobody should be punished for reporting, even if they clicked first.

SOC: detection ideas from published behaviour

The rules below are ideas drawn from behaviour that vendors have already published. They are not validated detections. Tune each one on your own endpoints before you page anyone on it.

• Developer runtime from a download. Alert when node, npm, python or sh starts from a shell or an editor whose working directory is ~/Downloads, or from a folder a git clone created in the last hour.
• Binary swap under Homebrew. Watch for a delete, then a rename or write, of a binary under /opt/homebrew/Cellar or /opt/homebrew/bin. Binance's post lists this sequence against pyenv.
• Hidden staging folders. Jamf Threat Labs describes a chain that stages files in a hidden ~/.task directory and starts a shell script with nohup. Alert on new hidden folders written by a developer tool, and on a detached shell started from one.
• Processes from node_modules. Kaspersky's Securelist report on NodeRabbit and PollCat describes a trojanized npm package that silently launched an implant as a detached background process when imported. Alert on a detached process whose binary sits under a node_modules cache folder.
• Git hooks that call out. Jamf, citing OpenSourceMalware's research, describes operators moving their loader into .githooks/pre-commit and post-checkout scripts, so it fires on the first commit or branch change. Alert on a hook script that opens a network connection.
• Network call right after a clone. Alert on outbound connections from node, npm or python within minutes of a clone or an install, to a host that is neither the package registry nor your git host.

Some of these will fire on legitimate builds. A team that compiles native code or runs a local dev server will see the network and process alerts most often, so set a baseline per team before an alert becomes a page. Our November 2026 security checklist is a starting list for the wider controls.

The limit is the one Binance states. Its malware was not caught by the endpoint tools in place at the time. An endpoint product helps, but it is not a guarantee, and the controls in the first two sections stop the attack earlier than detection does. For the endpoint side, the EDR cost guide compares per-endpoint prices, and our CrowdStrike review and Huntress review cover two options. Toolradar's listings for CrowdStrike and SentinelOne are a starting point for a shortlist. For Apple fleets, Iru (formerly Kandji) describes its product as keeping Apple devices in their desired state, and its Toolradar listing is the place to compare it.

The reverse problem: fake hires

The same playbook runs in the other direction. A North Korean IT worker gets hired under a stolen or invented identity, and the company's own laptop does the work. The U.S. Department of Justice announced coordinated actions on 13 October 2026. It reports charges against 14 people, two arrests, and searches of more than 40 residences in Texas between 21 and 25 September. The FBI seized about 187 laptops and keyboard, video and mouse devices, and the release says the schemes affected more than 70 U.S. companies. Facilitators received company laptops and hosted them at their homes, which is why these sites are called laptop farms. We covered the DOJ raids and a WaterPlum laptop farm in Japan in our own reports.

The controls are the ones that catch a fake recruiter, applied to the employee. Match identity documents to the person on the video call, and have the company schedule that call. Ship laptops only to a verified address, and treat a request to send a device somewhere new after the start date as a flag worth a call.

The weakness is plain. A real person in the U.S. can receive the laptop, so a background check does not catch a laptop farm. The facilitators in the DOJ case were U.S.-based, so a clean record is not proof of a clean hire.

FAQ

Can a fake job interview infect a work laptop?

Yes, when the candidate runs code the interviewer supplied. Binance's account describes a repository downloaded onto a work computer, with malicious code running during setup. Any interview that asks you to run something on a work device has crossed the line.

Is a GitHub Codespace safe for a take-home test?

It is safer than the laptop, because the code runs on a remote machine, but it is not a clean room. A 2-core codespace runs from $0.18 an hour, and any repository token signed into it is available to the code that runs there. Give it read-only access and delete the codespace after the review.

Does VS Code's Restricted Mode stop malicious tasks?

It stops tasks, terminals and debugging in a folder you have not trusted, and it asks before a task runs. It does not stop a malicious extension, a limit VS Code's own Workspace Trust documentation states. Keep task.allowAutomaticTasks set to off and install extensions only from publishers you trust.

Will npm's ignore-scripts setting stop this kind of attack?

It stops npm from running the scripts in package.json, including preinstall and postinstall, which setup steps use to run code. It also breaks packages that need a build, and it covers only npm. Apply the same rule to every package manager your engineers use.

Are fake hires only a United States problem?

No. Our WaterPlum report covers a laptop farm dismantled in Japan, and the common step in every case is a work device that runs code a stranger supplied. The DOJ figures above cover U.S. companies only.

How we checked this page

Binance's account is its post on X of 3 November 2026. The VS Code task and Workspace Trust settings, the npm docs, the Codespaces prices, the Jamf research, Securelist's NodeRabbit and PollCat report, the Iru page and the DOJ release were all read on 4 November 2026. The Cyberpresso count was made by searching every news post in the archive for recruiter, interview and job-test lures, and reading each match.

Louis Corneloup, founder of Toolradar and Dupple, is the author. Read how we rate tools and our editorial policy for the method behind this page.

Cite this: Cyberpresso, "Fake Job Interview Malware: A 2026 Playbook for HR, Managers and the SOC", November 2026.

Cyberpresso covers campaigns like these in one daily brief for security teams. Join at cyberpresso.com.

Some offers on this page may be paid placements or contain affiliate links.