Fake Job Interviews Are Backdooring Developer Machines Right Now

Developers are getting compromised through job interviews. Not metaphorically: literally. A wave of sophisticated attacks tracked as Contagious Interview has turned technical assessments into malware delivery pipelines. The fake job interview backdoor malware isn't some fringe threat. Group-IB and Socket have attributed it to North Korea's Lazarus Group, and it's actively targeting crypto developers, blockchain engineers, and anyone with access to high-value infrastructure.

The attack works because it exploits something developers actually do: run code during technical interviews. A recruiter reaches out on LinkedIn. The job sounds real. The company looks real. Then comes the technical assessment: a GitHub repo, an npm package, a Next.js project to run locally. Except that package phones home, drops a backdoor, and your dev machine is compromised before you've finished the first task.

The Attack Chain: LinkedIn to Backdoor in Five Minutes

The infection sequence is deceptively clean.

It starts with a fake recruiter message on LinkedIn, pitching a senior role with above-market pay. The job targets specific skills: React, Next.js, Solidity, blockchain development. After a brief back-and-forth, the "hiring manager" shares a GitHub repo or npm package for a technical challenge. The instructions are professional. The README is polished. The test is plausible: fix a bug, add a feature, review some code.

The moment you run npm install, the malicious payload executes. BeaverTail, one of the primary malware families documented by Group-IB, runs as a JavaScript-based infostealer on first execution. It collects browser credentials, Keychain data on macOS, and cryptocurrency wallet files. Then it drops InvisibleFerret, a Python-based RAT that establishes persistent C2 communication.

The entire chain from git clone to compromised machine takes under five minutes. No unusual user interaction. Just standard dev commands.

Why npm Is the Perfect Delivery Mechanism

Package managers are trusted by default. That's the structural problem.

When you run npm install, you're executing arbitrary JavaScript with full user-level OS permissions. No sandbox. No permission prompt. The npm registry hosts over 2.5 million packages, and Socket's 2025 annual report noted a 1,300% increase in malicious package detections year-over-year. Manually vetting every dependency isn't realistic at that scale.

Attackers know this. Packages in the Contagious Interview campaign use typosquatting (slight misspellings of popular packages) or dependency confusion attacks (uploading public packages with names matching internal private ones). Some packages looked completely benign in source review: the malicious payload was base64-encoded and only decoded at runtime, evading static analysis tools entirely.

Socket identified over 20 malicious npm packages tied to this campaign, some accumulating hundreds of downloads before removal. Standard antivirus solutions consistently failed to catch these payloads on first execution.

This is what makes the attack particularly difficult to counter: it exploits professional norms, not technical vulnerabilities. There's no CVE to patch. No software update that closes the gap.

The Target Profile: Crypto Devs and DeFi Engineers

Lazarus Group isn't spraying this attack broadly. The targeting is surgical.

Crypto developers, DeFi protocol engineers, blockchain infrastructure teams: anyone whose machine might hold private keys, seed phrases, or access to high-value wallets is in scope. Chainalysis's 2025 Crypto Crime Report documented $1.7 billion stolen by North Korean hackers in that year alone, with developer-targeted social engineering listed as a primary access vector. One successful compromise of a developer at a DeFi protocol can cascade into an eight-figure theft if wallet access is obtained.

The secondary targets have expanded beyond crypto. Web2 developers at fintech companies, engineers with AWS or GCP credentials stored locally, and anyone with access to production CI/CD pipelines are now being approached. The backdoor's value isn't just immediate credential theft: persistent access to a developer machine means access to everything that machine touches over time.

How We Got Here: From XZ Utils to Contagious Interview

This isn't the first time developer machines became targets. The XZ Utils backdoor (CVE-2024-3094) in 2024 showed how patient, sophisticated actors could compromise open-source infrastructure over years. That backdoor, discovered by Microsoft engineer Andres Freund, was planted through seemingly legitimate contributions to the XZ Utils compression library.

The XZ Utils GitHub backdoor attack and the Contagious Interview campaign share DNA: both exploit trust in the developer ecosystem. Both understand that developers run untrusted code constantly. Both know that detection tools lag behind novel attack vectors.

The Contagious Interview campaign traces back to at least 2023, when Unit 42 first documented North Korean actors using fake recruiter personas to deliver malware to software engineers. By 2024, attackers stopped using crude lures and started building infrastructure. Fake companies appeared with legitimate-looking websites, active GitHub organisations, and Glassdoor profiles. The social engineering became indistinguishable from real recruiting outreach.

The U.S. Department of Justice has indicted North Korean nationals for stealing over $1.3 billion in cryptocurrency through various hacking operations. Compromising developer machines is one vector in that broader financial crime operation.

What Actually Works: Defence Without Paranoia

You can't stop interviewing. You can change how you run untrusted code.

Use a disposable VM or container. Spin up a fresh Ubuntu instance, run the technical test, then nuke it. No persistent access. No credential theft. Docker Desktop, Multipass, or even GitHub Codespaces work. If the "recruiter" insists you run it on your main machine, that's a red flag.

Audit package.json before npm install. Check for typosquatted names, weird postinstall scripts, or dependencies you don't recognise. Tools like Socket Security can scan for malicious patterns automatically.

Never store production credentials locally. Use 1Password, AWS Secrets Manager, or hardware keys. If your machine gets compromised, the blast radius is credentials you actively entered, not everything stored in plaintext in ~/.aws/credentials.

Verify the company exists. Real companies have real employees on LinkedIn with employment histories. Real GitHub organisations have contribution patterns over time. A company that appeared six weeks ago with no commit history is probably fake.

Trust your gut on weird interview processes. If the technical test involves cloning a private repo from a personal GitHub account, or installing a package that's not on npm registry, or disabling security warnings to make something run: stop. Real companies don't ask you to bypass security controls.

The Contagious Interview campaign works because it targets behaviour that's completely normal in 2026: running code during interviews, installing dependencies, testing projects locally. The defence isn't paranoia. It's sandboxing the things you already do.

North Korean hackers didn't invent a new exploit. They just understood developer workflows better than most security teams do. That gap is what makes this threat different, and why it's going to keep working until sandboxed dev environments become the default, not the exception.