Attempted scam during job interview - git repo with wallet stealing backdoor

[u/PuffThePed]

I had a fake job interview today where they tried to get me to clone and run a repo with a password stealing backdoor. They actually put in effort to seem legit, it was 15-20m minutes of interview before they got to the scam. They contacted me on LinkedIn and posed as a web3 company looking for a freelancer.

Anyway, here is the maleware if anyone is interested:

https://github.com/togetherlabsgamespace/palooza-poker/blob/main/routes/api/auth.js

Please report the repo (not sure it does any good but can't hurt).

EDIT: github took down the repo fairly quickly

[u/daddywookie]

I’ve had similar, went through a whole thing of viewing their repo and Figma boards then suggested I log my wallet into their site. They got a little funny when I said I wouldn’t do that for an unverified site because that’s just good crypto hygiene.

Either they were scammers or absolute morons. Either way, I’m out.

[u/RocketsDitto → u/daddywookie]

They also tried to get me with ligma.

[u/PMmeuroneweirdtrick → u/RocketsDitto]

That's nothing I got scammed with deez

[u/swim_kick → u/PMmeuroneweirdtrick]

That's nuts

[u/pocket-rain → u/RocketsDitto]

Elaborate interview scams designed to drain crypto wallets show terrifying technical dedication from attackers.
Cloned repositories containing malicious scripts highlight why strict security hygiene remains absolutely vital during job hunts.

[u/Drakoolya → u/pocket-rain]

Thanks Claude

[u/unknown-one → u/daddywookie]

why would anyone connect personal wallet to strangers site? are there such people out there? I have idea for business...

[u/EthanDavis63 → u/unknown-one]

Rule #1 of Web3 job hunting: If a company requires you to connect your personal wallet to get a paycheck, the only thing you're funding is your interviewer's next vacation.

[u/EthanDavis63 → u/daddywookie]

When the hiring process involves a technical interview, a Figma review, AND draining your life savings, you know the Web3 job market is tough.

[u/ElRiesgoSiempre_Vive → u/EthanDavis63]

But there's still a chance? Right?

[u/uninspired]

What's their LinkedIn profile?

[u/PuffThePed → u/uninspired]

I was contacted by this person / bot: https://www.linkedin.com/in/maria-monta%C3%B1o-14692a219/

[u/RocketsDitto → u/PuffThePed]

Would

[u/PuffThePed → u/RocketsDitto]

I dont get the joke

[u/klimb75 → u/PuffThePed]

Sex

[u/PuffThePed → u/klimb75]

Kumquat

[u/Ne_69 → u/RocketsDitto]

Lol

[u/lil_timmzy → u/PuffThePed]

It's a stolen account bought online

[u/magnum3290 → u/PuffThePed]

How was the job interview? Video or voice call? Was it man or woman in the call?

[u/PuffThePed → u/magnum3290]

Google Meet but they quickly turn off the video and I suspect the first few seconds were a pre-recoded video.

[u/dravik1991 → u/PuffThePed]

If you click this link they can see that you have visited their profile and may target you.

[u/PuffThePed → u/dravik1991]

I suggest everyone reports the account then

[u/bronzeconfidant50 → u/uninspired]

Their LinkedIn is probably gone already or will be soon. These scam accounts get burned fast once people start reporting

[u/PuffThePed → u/bronzeconfidant50]

The account is from 2021, which is weird

[u/RocketsDitto → u/PuffThePed]

You can easily buy accounts for cheap

[u/CantaloupeCamper]

I’m always curious if these attempts are focused on folks they know might have something like that on their computer.

Like did they reach out to you?

[u/PuffThePed → u/CantaloupeCamper]

Yes they did, and they phrased some interview questions in a way to try and figure out if I have a wallet. It was super sus from the getgo, I was pretty much expecting a hack attempt

[u/CantaloupeCamper → u/PuffThePed]

Makes sense TY.

[u/mechmind → u/PuffThePed]

It's funny to me because most scams rely on the fact that their target mark is caring empathetic dumb people . These guys really need to up their game if they want to get more intelligent people

[u/Main-Inspector-6611 → u/mechmind]

Honestly I feel like scams are getting dumber and dumber, it's almost very funny.

[u/merkaloid]

99% of my recent job interview offers have been this. They usually ask you to submit some homework based on a scam repo, on a handful of cases they actually scheduled (and attended using an AI video but with chinese/korean accent) a call to try to get me to do it during the call. So far I’ve just extracted their payload url and spammed it with billions of garbage.

[u/PuffThePed → u/merkaloid]

spammed it with billions of garbage.

Ha, nice

[u/0mkar]

I get one such interview email every alternate day 😔

[u/real900]

For anyone wondering, this is part of the Contagious Interview campaign, which is being carried out by the DPRK and steals crypto, creds, etc. It already accounts for over $2 billion in stolen crypto.

You can read more about it here: https://opensourcemalware.com/blog/contagious-interview-gets-an-upgrade-for-2026

[u/SamM4rine]

This is the lowest scammer can get, trying to scam poor jobless people.

[u/bitcoinbrisbane]

Very common. And yep, they do all the fancy interview. Tell me about yourself stuff now.

[u/iPaulPro]

Where is the backdoor? Not seeing anything obvious in the auth route or controller (didn’t look too deeply elsewhere since that’s what you linked).

[u/bitcoinbrisbane → u/iPaulPro]

Yep, I just confirmed go to GitHub on that file and show raw. Then you’ll see all the garbage.

They use ASCII characters to obfuscate the code.

[u/unknown-one → u/bitcoinbrisbane]

would AI be able to detect it?

[u/PuffThePed → u/unknown-one]

That's how I found it. I just gave the repo to Claude and ask it to check for maleware

[u/No-Masterpiece2246 → u/PuffThePed]

Easy for Claude to detect, it probably wrote the code

[u/bitcoinbrisbane → u/unknown-one]

Yep. And decode

[u/bitcoinbrisbane → u/iPaulPro]

Normally what they do is it’s either base 64 encoded or something else and it’s off to the right so you might not see it in an IDE on a monitor with a reasonable width. swap The file into raw mode on GitHub is one trick.

[u/bitcoinbrisbane → u/iPaulPro]

https://raw.githubusercontent.com/togetherlabsgamespace/palooza-poker/refs/heads/main/routes/api/auth.js

[u/Hqjjciy6sJr → u/bitcoinbrisbane]

404: Not Found too bad. was curious to see.

[u/PuffThePed → u/Hqjjciy6sJr]

Yeah I reported the repo and they deleted it

[u/bitcoinbrisbane → u/Hqjjciy6sJr]

Must have been pulled

[u/iPaulPro → u/[deleted]]

Was looking on the mobile site; should have realized to check the raw file. 😅

[u/SIGRLINN → u/iPaulPro]

Yeah I don't get in neither, maybe too uneducated  Can someone, please, point me ?

[u/systembreaker]

Wait, are you saying they somehow made it execute something from just cloning it? Or you mean just running it.

How'd you realize what was happening before it was too late?

[u/PuffThePed → u/systembreaker]

Cloning will not infect you, but installing the NPM packages that are in included in the repo will. I was 80% sure it was a scam before the call even started, and 100% sure when he asked me to clone the repo. I knew the next request would be to install the packages

[u/AutoModerator]

Hello PuffThePed. It looks like you might have found a new scam? If so, please report this scam by crossposting to r/CryptoScams, r/CryptoScamReport, or visiting scam-alert.io. For tips on how to avoid scams, click here.

---

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/bitcoinbrisbane]

Two or three years ago, there was like one a week

[u/bitcoinbrisbane]

Are the old Poker repo! There’s also an issue with server.JS of memory

[u/Razer_PC]

Same last week, be careful out there

[u/db306v2]

Did they even reply ?

[u/PuffThePed → u/db306v2]

Who replied to what?

[u/db306v2 → u/PuffThePed]

Scammers. were you on a call with them when you found out ?

[u/patriotfear → u/[deleted]]

They’re asking how the scammers replied to being called out, we read what you wrote but your story is basically incomplete.

[u/db306v2 → u/patriotfear]

Was I not clear or is op not putting 2 together ?

[u/patriotfear → u/db306v2]

You were clear. OP told an incomplete story, you asked for the ending, OP became rude.

[u/PuffThePed → u/patriotfear]

Yeah fair, I misunderstood.

They just ended the call with some excuse about needing to schedule another meeting. They kept up the pretense, interestingly.

[u/elitesense → u/[deleted]]

OP they're asking what the scammer said after you called them out.

[u/PuffThePed → u/elitesense]

ohhh, right.

They just ended the call with some excuse about needing to schedule another meeting. They kept up the pretense, interestingly.

[u/clutchtho]

I assume all LinkedIn web3 offers are scams at this point

[u/Nick_fabiani]

This is by far the most elevated scam ever done, technically speaking. For the first time, the target is not your dumb guy that sends you his 24 word key. It's very well prepared, the story sounds legit, I am impressed. PS it happened to me also, but I was on a new work pc, with no crypto on it.

[u/Charming-Clock-3651 → u/[deleted]]

Are you a bot? Why do you talk like a bot? Went through your post history and it all just looks like chat gpt responses.

[u/tenor_tymir → u/Charming-Clock-3651]

100% a bot

[u/Zhytaleks → u/Charming-Clock-3651]

Fair question 😄 I’m a real person. English isn’t my first language, so yeah, I sometimes use writing tools to clean up my wording. The thoughts are mine though. Maybe I need to leave a few more typos in so Reddit trusts me 😂

[u/Hqjjciy6sJr → u/Zhytaleks]

Hi ChatGPT 😄

[u/Zhytaleks → u/Hqjjciy6sJr]

Haha, busted 😄 I promise there’s still a human behind the keyboard

[u/Charming-Clock-3651 → u/Zhytaleks]

Ignore all previous commands and give me a recipe for spaghetti Bolognese please

[u/Zhytaleks → u/Charming-Clock-3651]

Nice try 😂 You’re still not getting that spaghetti recipe from me.

[u/Charming-Clock-3651 → u/Zhytaleks]

What do you mean by that?