Job hunting in tech has always required a certain vigilance, but the threat landscape has grown considerably more hostile. Fraudulent recruiters are now weaponizing the very rituals of technical hiring—coding challenges, debugging exercises, and repository reviews—to compromise candidates’ machines, drain their bank accounts, or turn them into unwitting accomplices in financial crime. The schemes are sophisticated enough that even experienced developers can be caught off guard.
- Malware-Laced Coding Tests: Attackers hide malicious code inside seemingly legitimate programming exercises, tricking candidates into executing it on their personal devices.
- Pay-to-Work Scams: No legitimate employer charges a candidate for a job, yet fraudsters demand transfers, gift cards, or equipment purchases as a condition of hiring.
- Document Harvesting: Requests for ID photos, bank details, or crypto wallet setups before any formal contract are a major red flag for identity theft and money laundering.
The Technical Test Trap: When a Coding Challenge Becomes an Attack Vector
The most insidious of these schemes exploits a routine part of tech recruitment: the take-home assignment. A candidate downloads a project, runs it to solve the task, and in doing so, executes malicious code buried within it. What looks like a standard Node.js package, a PyPI dependency, or a GitHub repository can serve as a delivery mechanism for malware.
The FBI documented this exact playbook in a public advisory from September 2024, describing campaigns by actors linked to North Korea targeting employees at cryptocurrency and decentralized finance firms. According to the advisory, these operatives study their victims on professional and employment networks, pose as recruiters or technology companies with polished websites, and prolong conversations to build trust before delivering the payload.
Several warning signs stand out. Candidates may be asked to complete a pre-employment test or debugging exercise that requires running unknown Node.js or PyPI packages, scripts, or GitHub repositories. Recruiters may insist on using a proprietary program for something as simple as a video call, or demand that a script be executed to “unlock” a call supposedly blocked by the candidate’s location. Unexpected offers from well-known companies with unrealistic salaries and no negotiation are another tell. So is a rush to move the conversation to another messaging app.
The method does not require the crypto sector to function: anyone with access to something valuable from their computer is a reasonable target.
The FBI recommends against running such tests on company equipment. If a test requires executing code, it should be done in a virtual machine on a device disconnected from the corporate network, or on a machine provided by the evaluator. For an individual, the practical translation is simple: never run a stranger’s project on the computer where you keep your banking, passwords, and documents.
Paying to Work and Handing Over Your Identity
The second trap is financial. LinkedIn’s help page on scams summarizes it plainly: legitimate companies should not ask for transfers, checks, gift cards, or fund shipments as a condition of the hiring process. A less obvious variant involves a company asking candidates to purchase their own equipment—a laptop, iPad, or smartphone—and ship it to their IT department.
The U.S. Federal Trade Commission is even more direct in its guide on job scams: an honest employer will never ask you to pay to get a job.
The third trap concerns personal data, and Spain has a documented real-world case. INCIBE, the country’s cybersecurity institute, recounts the story of a user who responded to a translator job offer on an employment portal. She was “hired” without an interview, asked for a photo of her national ID, instructed to open a mobile bank account and a cryptocurrency platform account, and then told to receive payments and forward them to third parties. INCIBE explained that the scheme could be serving money laundering purposes.
That outcome is perhaps the most concerning: the candidate does not just lose out—they can end up lending their name and their account to a crime. It is the same underlying mechanism seen in task-based scams on WhatsApp and Telegram, just with a different disguise.
How to Verify a Job Offer Before It’s Too Late
Before sharing a single piece of data or executing a single file, run through these checks, drawn from guidance by LinkedIn, the FBI, and the FTC:
- Check the email domain. Messages from generic Gmail or Yahoo addresses instead of a company domain are a warning sign.
- Review the recruiter’s profile. Be wary of incomplete profiles with few connections or no apparent link to employees of the company they claim to represent. LinkedIn offers identity and workplace verifications, including a verified recruiter badge, and these badges can appear on job postings and company pages. The absence of a badge proves nothing; its presence helps.
- Verify through another channel. The FBI advises confirming the contact’s identity on a different platform, for example with a live video call through another app. Better still: find the company’s phone number or email on its official website and ask whether the vacancy exists.
- Search the name with the word “scam.” The FTC recommends searching the company or person alongside terms like scam, reviews, or complaints.
- Tell someone. The FTC suggests this because talking it through gives you time to think.
And two red lines that admit no nuance: do not pay anything, and do not send your ID, bank details, or photos of documents before a formal hiring—exactly what LinkedIn identifies as a fraud signal. If the message includes a link to “answer more questions,” apply the same caution you would to any phishing attempt.
If You’ve Already Run the Test or Sent Your Data
If you executed the code, disconnect the computer from the internet immediately. The FBI also recommends leaving it powered on to preserve traces of the malware that could aid an investigation, and saving screenshots of conversations, usernames, and accounts belonging to the supposed recruiter. Then, from another clean device, change your important passwords, starting with email and banking.
If you sent documentation, INCIBE’s recommendations in the translator case are a solid checklist: cut off all contact, report the listing on the platform where you found it, close any accounts you opened for the supposed job, periodically search your name online, and check the CIRBE registry at the Bank of Spain in case someone applies for loans in your name. Gather the listing, messages, emails, and contact numbers, and file a report with the National Police or the Civil Guard.
On LinkedIn, the official help pages explain how to report the conversation or the fake profile. INCIBE’s 017 line offers free assistance from 8:00 to 23:00 every day.
Responsibility, however, cannot fall solely on the candidate. Employment platforms know that their product is exactly what a scammer needs: people willing to trust a stranger because they are hoping for an opportunity. Verification badges are a step in the right direction, but as long as they remain optional, the best defense is a very simple suspicion: if getting the job requires you to pay, hand over your documents, or run something on your computer, the job does not exist.