Job offer hid a way to run malicious code through Git inside a ZIP

Tier D · Background noise – Good to know

Who’s exposed: Developers who open archives or repositories sent by the recruiter

Tier D because: Does not hit tech teams

Reach

Attack

Damage

Fix

Full takeover

What to do

Verify the recruiter and company independently before opening any project archive they send

The Brief

A developer reported that a recruiter from Cryptic Heaven contacted them on LinkedIn with a job offer for a supposed financial system for crypto credit card users.
The offer package hid a way to run malicious code through Git inside a ZIP file.

Developers who open coding tasks or project archives sent during hiring can end up executing attacker-controlled code on their own machines.

Checklist · 1 of 10 yes

No	Hits tech teams	Job-offer lure targeting a developer; a scam rather than a developer platform breach.
No	Core infrastructure	A recruiter's lure is not a flaw in or compromise of software nearly every team runs.
No	Popular tool	Git is mentioned only as the delivery mechanism in a lure; the tool itself is not flawed or compromised.
No	Exploited in the wild	Reddit r/programming post describes an offer that hid a method, not a confirmed attack campaign.
No	Public exploit	Reddit r/programming post gives no published exploit code or step-by-step proof-of-concept.
No	Remote, no login	Reddit r/programming post says the victim received and had to work with the ZIP, so user interaction is needed.
Yes	Full takeover	Reddit r/programming post says the offer hid a way to launch malicious code, implying code execution.
No	Secrets exposed	Reddit r/programming post reports no stolen credentials, tokens, keys or data.
No	Supply chain	Reddit r/programming post describes a recruiter's offer, not a compromised project, package, update or build pipeline.
No	No fix yet	Reddit r/programming post does not state whether any fix or patched version exists.

First seen 2h ago · 1 source · Full story page · How tiers are decided