The Interview Assignment Was the Attack

In The Malware Was Not in the App. It Was in .git/hooks, Citizen Dot documents a malicious coding assignment received through a supposed LinkedIn recruiter.

“The workflow itself is the attack.”

The project looked like a legitimate application, but the dangerous code was hidden inside Git hooks. Ordinary actions such as checking out a branch, committing, or pushing could fetch and execute a remote payload without the developer ever running the application itself.

This is a good start to the breakdown of what they found. I hope they continue down the rabbit hole, trace the infrastructure and people behind it, and develop a safe way to investigate or protect themselves from future attempts.

This is not an isolated trick. Security researchers have documented a broader campaign in which fake recruiters guide developers through realistic interviews before giving them compromised repositories or coding exercises. Microsoft recommends treating these assignments as hostile and opening them only inside disposable, isolated environments without access to personal or corporate credentials.

This is why I stopped responding to unsolicited LinkedIn recruiters. The legitimate ones are now paying the price for a platform filled with noise, impersonation, and increasingly sophisticated attacks.

Read Citizen Dot’s full investigation, The Malware Was Not in the App. It Was in .git/hooks.