cybersecurityhiringmalwarescamsleadershippolicy

The Fake Recruiter Coding Test That Opens a Company Laptop

Why a take-home task from a stranger has become a way into company systems, the warning sign at each stage, and the one device rule every team should adopt.

November 5, 2026

Fake job offers now deliver malware through take-home tasks, and the computer that runs the task is what attackers want. Guarding against a fake recruiter coding test scam takes one company rule: no interview code or meeting app ever runs on a work device. Pair it with second channel checks and a culture where job hunting is not a secret.

Many people still think malware arrives as an odd attachment from a stranger, the kind anyone careful would delete. That belief is out of date. Targeted attacks can now arrive inside a hiring process the target wants to succeed in, through a test project they download willingly. The FBI's September 2024 public service announcement describes state-backed actors building tailored fake job offers for employees of cryptocurrency and finance firms, then asking them to complete "pre-employment tests" that run unfamiliar code. The answer is a company rule that no interview task, test project or outside meeting software ever runs on a company device.

The danger now arrives inside a normal hiring process

Researchers at Palo Alto Networks' Unit 42 (2023) gave one version of this a name: Contagious Interview. Attackers posed as employers, interviewed software developers online, and asked them to install a code package from GitHub as part of the exercise. Inside the package sat malware that took browser data such as saved card details and crypto wallet information, then fetched a second program able to log keystrokes and keep the attackers connected.

For a business, the uncomfortable part is who pays. The candidate loses some personal data. The employer can lose far more, because a work laptop holds a session into email, shared files, internal tools and code. An attacker who gets onto that machine can work from inside the company's trust.

Interview code on a work laptop gives an outsider the same access as the employee using it.

Recent events show why leaders should care now. TRM Labs reported in 2026 that about $6.36 billion left a major crypto exchange on 29 October, and attributed the theft to the North Korean group TraderTraitor. Back in 2022, the FBI, CISA and the US Treasury warned that this group's intrusions began with spearphishing messages to crypto company employees in system administration and DevOps roles, messages that often mimicked recruitment and offered high paying jobs. How the October breach began has not been made public, and nothing here assumes it. The older advisory is enough to show the method is a proven one.

What each stage looks like from the inside

From the candidate's chair, nothing feels wrong until the end. Walking through it in order shows where a pause would have helped.

It starts with homework done on you. The FBI says these actors study targets' social media first, particularly professional networking and job sites, so the opening message can mention your real experience.

Then comes an offer that is hard to ignore. Prominent company, high pay, little negotiation, sometimes for a role you never applied for. Unit 42 also found ads that stayed vague about who the employer was.

The conversation moves. A request to switch to another messaging app is one of the FBI's listed indicators. Leaving the original platform removes its record and its reporting tools.

The interview feels professional. The tell is a demand for special software: a custom video app, or a script you must run so the call connects from your location. The FBI calls out both.

Finally, the task. A repository to clone, packages to install, a bug to fix. Unit 42 noticed that the code accounts behind Contagious Interview often held a single project with no updates, unlike working developers who tend to keep many active ones. Treat that as a hint only, since history can be faked.

Rules worth writing down for the team

The core rule comes almost word for word from the FBI: do not take pre-employment tests or run their code on company devices; if code must run, use a virtual machine on a non-company device, or a device the tester provides. A virtual machine works like a sealed spare computer inside your own, which can be wiped if anything inside it turns out to be hostile.

A version a company could paste into its handbook:

Interview tasks and company devices
1. No interview task, coding test, project or meeting software from an outside party is ever installed or run on a company device.
2. If an interview asks you to run code, use a virtual machine on a personal device, or hardware the hiring company provides.
3. Before going further with any recruiter who contacted you first, confirm who they are on a second channel, such as the company's official careers page or a video call on a different app.
4. Looking at other jobs is normal here. You never need to hide it, and you will never be asked why you need a safe place to do an interview task.
5. Not sure about a file or link? Ask [named person] before opening it. Quick questions are welcome.
6. Turn on two-factor sign-in (2FA) for every work account that offers it.
7. Admin changes happen only from a separate admin account that is never used for email, browsing or calls.

The fourth line does more work than it looks. People who fear that job hunting will be held against them do it secretly, late at night, on the laptop in front of them. That laptop is usually the work one. Saying openly that interviewing is allowed removes the reason to hide, and with it the main reason the rule gets broken.

Two structural habits from the same FBI notice limit the damage when the rule fails anyway. Keep the passwords and keys that move company money off everyday internet-connected devices, and require approvals from several separate devices before funds move. Limit access to sensitive code, development pipelines and network documentation to the people who genuinely need it. Each limit means a single compromised laptop opens fewer doors. Review those access lists every quarter, because roles tend to change faster than permissions do.

Two basics belong underneath all of this. The first is two-factor sign-in on every work account that offers it, which CISA recommends for every account so that a stolen password stops being enough; for admins, CISA's 2022 fact sheet pushes the phishing-resistant kind, such as hardware security keys. The second is a cold admin account: a separate login with its own email and strong 2FA, used only for admin changes and never for everyday email, browsing or calls. When an everyday account or laptop is taken, the account that controls everything is somewhere else.

The same playbook can run in reverse

Hiring managers should not assume the risk only flows toward candidates. In the same research, Unit 42 (2023) found files pointing to a second operation it called Wagemole: fraudulent job seeking aimed at a wide range of US companies, with prepared identities and interview material behind it. In that version the attacker is the applicant, and the prize is a job with legitimate access from the inside.

The defence mirrors the rule above. Confirm who a remote candidate is before they receive any access, using a live video call and checks that do not rely only on documents they send you. Give a new hire the narrowest access their first weeks require and widen it as trust builds, rather than opening everything on day one. The FBI notice adds two habits that suit both directions: verify people in person when you can, and periodically re-confirm the identity of employees you have never met face to face. None of this needs a security team. It needs someone in the hiring process who owns the question "are we sure this person is who they say they are?" and the authority to pause an offer until the answer is yes.

When a test has already been run

Write down the first steps before anyone needs them. The FBI's advice is clear. Cut the affected device off from the internet straight away but keep it switched on, so the traces on it survive. Report the incident to the FBI's Internet Crime Complaint Center at ic3.gov with as much detail as possible, including screenshots of the conversation and every username, profile and account the recruiter used. Ask law enforcement about a forensic examination of the device. Then, from a separate clean machine, change every password the affected laptop stored and review what it had access to.

How the company treats the person who reports it decides whether the next person reports at all. Thank them, fix the problem, and share what happened with the team so the next fake offer gets caught a stage earlier. Keep a short record of the platform, the dates and the recruiter's details in one place, so anyone on the team can recognise the same approach if it comes back with a new name.