The fake job interview that installs malware

Key takeaways

• The attack arrives at the assessment, which is the one stage in hiring where a candidate is expected to run someone else's code.
• Microsoft's Defender Experts team documents a campaign it calls Contagious Interview, in which fake recruiters get victims to clone and execute a package from a normal-looking repository.
• Presentation proves nothing. In the case BBC World Service reported in September 2026, the pages were real Google pages and the installer was digitally signed.
• No real employer needs you to execute unfamiliar code on your personal machine, and refusing costs you nothing at a real one.
• Microsoft tells employers to give their own developers a non-persistent virtual machine for coding tests. A candidate deserves the same boundary.

A job seeker in the UK handed in their notice, said so on LinkedIn, and took a call from a recruiter who had a role for them. There was a video interview. Then came a standard technical assessment with the instructions sitting in a Google Sheet. BBC World Service reported on 4 September 2026 that within hours of the candidate completing it, attackers emptied their cryptocurrency accounts of £18,000 in savings.

Nothing in that sequence looks like a scam while it is happening. That is the design. Job scams used to announce themselves through bad grammar and an attachment nobody asked for, and the current generation does not. It runs an interview process, because an interview process is the most reliable way to get a careful person to lower their guard and run a stranger's code on their own laptop.

What does a fake interview scam actually look like in 2026?

It looks like a hiring process, all the way up to the part where something has to be installed. Microsoft's Defender Experts team, writing on 11 March 2026, reports observing the Contagious Interview campaign, which it calls a sophisticated social engineering operation active since at least December 2022. In it, attackers pose as recruiters from cryptocurrency trading firms or AI-based solution providers. The stages the Microsoft researchers describe are the ordinary ones: recruiter outreach, technical discussions, assignments, follow-ups.

The payload comes at the assignment. Victims, the Microsoft analysis says, are instructed to clone and execute an NPM package hosted on popular code hosting platforms such as GitHub, GitLab, or Bitbucket.

Two variants reach the same place by other routes. On a fraudulent interview site, per the same Defender research, users encounter a fabricated technical error and are instructed to copy and paste a command to resolve the issue. The other waits inside Visual Studio Code specifically: when victims open the downloaded package there, Microsoft's researchers write, they are prompted to trust the repository author, and granting that trust lets the editor run the repository's own task configuration file.

Why does the assessment stage work so well as an attack?

Because it is the only part of hiring where running someone else's code is the assignment rather than a red flag. Every other stage can be done with nothing but a browser and a camera. The take-home inverts the normal advice, and a candidate who has spent two years being told to move fast on every opportunity is not in a frame of mind to argue with a recruiter about repository hygiene.

Microsoft's Defender researchers name that pressure directly. Threat actors, they write, exploit the trust job seekers place in the hiring process during periods of high motivation and time pressure, lowering suspicion and resistance. Their summary of the Contagious Interview campaign is blunter still: this campaign weaponizes hiring processes into a persistent attack channel.

The market conditions do the rest of the work. LinkedIn's own data on what it calls the Gen Z "Scam Gap" found that younger professionals face the highest exposure to scams, and that nearly a third, 32%, admit to ignoring red flags due to a competitive job market. That is a survey of how people behave under scarcity rather than a measure of how common these attacks are.

What are the attackers actually taking?

Credentials, not documents. Per Microsoft's Defender Experts analysis of the Contagious Interview campaign, threat actors harvest API tokens, cloud credentials, signing keys, cryptocurrency wallets, and password manager artifacts. The machine matters for what it can reach. A developer laptop is a route into source control, build pipelines and cloud consoles, and the same laptop usually holds a password manager and, often enough, a wallet.

This is why the damage lands so fast in the case that has been reported in detail. In the BBC World Service account, the candidate completed the task, went to bed, and woke up to find their online wallets emptied of their savings. There is no slow reconnaissance phase to notice. One documented case is an illustration rather than a rate, and neither Microsoft nor the BBC reporting puts a number on how common this is.

Which signals arrive before the code does?

The strongest one is an installer. Malwarebytes, quoted in the BBC World Service report, found fake recruiters using lures as plain as "Complete your interview by installing the Indeed app". Indeed has published standing guidance on this, quoted in the same report: interviewing through the Indeed platform happens entirely in a browser and never requires downloading a special app, and any message asking a job seeker to download an app to participate in an interview is not legitimate.

Established employers do sometimes use assessment platforms with their own software, so treat this as a prompt to slow down and not an absolute rule. The shape to refuse is an installer pushed by a recruiter in a chat thread, when a company's own careers system would have carried it.

The second signal is friction that makes no sense. Microsoft's guidance for the Contagious Interview campaign lists the tells its researchers keep seeing: short links redirecting to file hosts, newly created repositories or accounts, and instructions that ask you to disable security controls or trust an unknown repository author. A real engineering team has no reason to route a candidate exercise through a link shortener.

A third is being moved off the platform the conversation started on. Four-Leaf's ghost job checker treats requests for personal information or off-platform contact as one of the patterns it flags, alongside ghost-job tells like evergreen wording and repost history. It surfaces signals rather than certainty, so treat a clean result as a reason to keep reading and never as a clearance. For the separate question of whether the company and the recruiter exist at all, Four-Leaf's guide to telling a real job posting from a fake one carries that checklist.

How should you run a take-home you did not write?

In something you can throw away. Microsoft's mitigation guidance for the Contagious Interview campaign tells organisations to use a dedicated, isolated environment for coding tests and take-home assignments, for example, a non-persistent virtual machine, and not a workstation with access to production credentials or internal repositories. That advice was written for security teams protecting employed developers. It applies without modification to a candidate on a personal laptop, who has no security team at all.

A fresh virtual machine is the boundary Microsoft actually names, and it is the one to use: no credentials on it, no password manager signed in, no wallet on the disk.

A container is the cheaper thing most people will reach for instead, and it is worth knowing what it does not stop. Containers share the host kernel, usually mount your working directory, and inherit host networking. An infostealer whose whole job is to read credentials and post them to a remote server is barely inconvenienced by one. Treat a container as tidiness and a disposable virtual machine as the actual control.

Microsoft also tells organisations to establish a policy requiring review of any recruiter-provided repository before running scripts, installing dependencies, or executing tasks. Reading the task configuration and the install scripts catches the obvious cases and does not amount to that review: in this campaign the payload is routinely obfuscated inside ordinary-looking source or pulled in through a dependency, so a clean package.json clears nothing. The isolation is what protects you. Four-Leaf's guide to take-home assignments covers the rest of the stage, including how long one should reasonably spend and what reviewers actually score.

What is overrated

Vetting the recruiter's profile and looking for sloppiness. Both are still worth doing, and neither would have caught the case the BBC reported. Juxhin D Brigjaj, chief executive of Have I Been Squatted, whose researchers analysed that attack, said the victim was walked through what looked like a real job interview, on real Google pages, behind a real Google login, and the software they were asked to install was digitally signed like any legitimate app. A code signature means someone bought a certificate. A polished profile means someone spent an afternoon.

Judging the request instead of the presentation is the only test that survives contact with a competent attacker. The useful question is whether a legitimate version of this process would need you to run this particular thing on this particular machine, and for a take-home the answer is available before you click anything.

The playbook

1. Refuse any install that reaches you through a recruiter rather than through a company's own careers or assessment system. Say you are happy to complete the exercise in the browser or in your own environment.
2. Run every take-home in a non-persistent virtual machine, with no password manager, no cloud credentials and no wallet present. A container is weaker here, because it shares the host kernel and your network.
3. Read the task configuration file and any install or postinstall scripts before you open the repository in Visual Studio Code, which will offer to trust the author and run that task file. Treat this as a first pass, not a clearance.
4. Treat paste-and-run fixes as the end of the conversation. A fabricated error that can only be solved by pasting a command is the attack, not a bug.
5. Verify the company and the role through a channel the recruiter did not give you, using the checklist in Four-Leaf's post on spotting a fake job posting.
6. If you already ran something, treat it as a compromise. Rotate tokens and passwords from a different device, move any wallet funds, and revoke sessions on source control and cloud accounts.

Where this is heading

The uncomfortable part is that this attack scales with how well hiring works. Every improvement to the candidate experience, faster outreach, lighter scheduling, more realistic take-home exercises, hands an attacker a more convincing script. The stages that make a process feel professional are the same stages that make a fake one feel professional, and there is no version of the funnel that removes the moment where a candidate is asked to do something on their own machine.

So the defence has to sit with the candidate, and it is smaller than it sounds. No real employer needs you to execute unfamiliar code on your personal laptop, and asking to run it somewhere else costs you nothing at a real one. Run the exercise somewhere you can delete. The company that is really hiring will not notice, and the one that is not will go away.

---

Originally published on the Four-Leaf blog.