SecurityFan score 2 · Tier D
How I received a job offer, and they hid a way to launch malicious code through Git inside the ZIP
top scoring links : programming ·
The Brief
- A developer reported that a recruiter from Cryptic Heaven contacted them on LinkedIn with a job offer for a supposed financial system for crypto credit card users.
- The offer package hid a way to run malicious code through Git inside a ZIP file.
Why it matters
Developers who open coding tasks or project archives sent during hiring can end up executing attacker-controlled code on their own machines.
Who’s affected
- Developers responding to unsolicited recruiter offers
- Developers who open ZIP archives or Git repositories supplied during hiring
What to do
- Verify the recruiter and company independently before opening any project archive they send
Recently, a recruiter from Cryptic Heaven contacted me on LinkedIn with an offer to work together. The company supposedly develops a financial system for users of cryptocurrency credit cards. The offer looked quite ordinary: they liked my experience and wanted to discuss possible…
Timeline
Author publicly describes the malicious job offer on r/programming
top scoring links : programming
How I received a job offer, and they hid a way to launch malicious code through Git inside the ZIP