一场大规模招聘诈骗活动利用虚假的Python开发职位向求职者投放恶意代码。1
根据安全研究人员的发现，诈骗者通过LinkedIn直聘消息发送招聘机会，声称月薪为$10,000-$15,000。1在招聘流程中，应聘者被要求完成一份take-home面试项目，该项目的Git仓库中隐藏着恶意脚本。1
这些隐藏的Git hooks会自动执行远程代码，从IP地址45.61.164.38:5777服务器下载并执行多阶段payload。1每个payload包含追踪参数id=402，用于区分受害者。1
第二阶段的恶意代码下载了Ethereum开发工具Hardhat及钱包访问库clipboardy，旨在窃取加密钱包。1此外，这些payload还能执行系统级操作。1
诈骗者冒用真实Y Combinator创业公司Zavopay的名义实施欺骗。1原始的面试项目是从GitHub克隆的真实FastAPI个人财务管理应用程序，经过植入恶意代码后用于钓鱼。1攻击者通过在.vscode文件夹配置launch命令或Git hooks两种方式触发感染。1
A software developer uncovered an elaborate recruitment scam involving malicious code embedded in a take-home interview project. 1 The fraudulent operation used a fake job posting claiming to offer a Python development position paying $10,000–$15,000 per month, distributed through LinkedIn direct messages. 1
Upon inspecting the project files, the researcher discovered hidden Git hooks containing malicious scripts designed to download and execute multi-stage payloads from a remote server at IP address 45.61.164.38:5777. 1 The attack was triggered through either .vscode folder configurations or Git hooks, and included a tracking parameter (id=402) to identify individual victims. 1
The second-stage payload installed Ethereum development tools and cryptocurrency wallet access libraries, including Hardhat and clipboardy, indicating the attackers' focus on stealing digital assets. 1 The scammers had impersonated Zavopay, a legitimate Y Combinator-backed startup, to lend credibility to the fraudulent recruiting effort. 1 The underlying project itself was cloned from a genuine FastAPI-based personal finance application available on GitHub. 1
This incident represents a broader recruitment scam targeting software developers globally, combining social engineering with supply chain exploitation to distribute information-stealing malware. 1
评论
还没有评论，欢迎留下第一条。