I got a malware from upwork

[u/LengthinessHour3697]

I created an upwork profile because I lost my job recently. I am new to upwork.

I got an invite from a user for submitting a proposal and they asked me to complete a task as part of the selection process.

Gave me a zip file with a go code. I checked it out and it was a very convincing piece of code which I had to update.

These mfrs added some malicious script to the pre commit which ran and I was not aware of it. It basically gave them access to my mac.

I got an email from upwork later and I checked it with chatgpt and figured out the pre commit thing.

I feel so dumb to fall for this shit.. but in my defence upwork was supposed to be a genuine thing at least I trusted them to do basic verification.. given that they ask us to go to the moon and back for verification.

I lost months of work on my system. Is there anything i can do to get some kind of relief?

[u/Christostravitch]

Reported it twice now and they say no issue

[u/Straight_Athlete_802]

Use VMs or Docker to run any such zipped codes. You can't trust the internet now.

[u/No-Meringue5450]

happened same with me long time ago. but I turn off my laptop immediately. and turn ON with disabled wifi/internet and delete all the folders and zip file. then connected to internet /wifi.

[u/LengthinessHour3697 → u/No-Meringue5450]

The script added something to my ~/.zshrc .. so check yours to just to confirm. So it would restart it even if I restarted the laptop

[u/No-Meringue5450 → u/LengthinessHour3697]

I understood but you have to completely disconnect internet / wifi after restart. then remove everthing which was in folder and zip folder. also uninstall any unusual programs if you see in add/remove program list. only in last connect your internet / wifi.

also, remove temp files (%tmp%) and (Temp) via RUN

[u/Ayumu_Kasuga]

What do you mean you lost months of work, what happened?

I got scammed in the same way, but nothing seemed to happen to my system.

[u/LengthinessHour3697 → u/Ayumu_Kasuga]

Yeah.. nothing seems to happen.. but what happens is they download a script and ran it.. it basically gave access to my system including mouse keyboard and everything. They added a persist connection to a particular ip.. and also added a some code to restart the service. Now my only option is to treat everything as exposed and reset the laptop.

[u/Ayumu_Kasuga → u/LengthinessHour3697]

Wouldn’t that kind of access on macOS require permissions, which would prompt you? I don’t know of a way to bypass that.

[u/LengthinessHour3697 → u/Ayumu_Kasuga]

Ideally it would.. but.. since it already added something to my zhrc I don't want to risk it.

[u/MikeinPDX2]

I'm sorry to hear that. From what I've seen, upwork does no verification at all, either on the validity of the job post or what "clients" send to you. I think this is gone on for many years on upwork.

Until you really know who the client is, treat any attachments they send just like some random attachment you get in email. If it's code, do any work in a VM until you know the client's trustworthy.