- Received a LinkedIn message for a Python developer role with an unusually high salary of $10k-$15k/month, raising immediate red flags.
- The take-home assignment was a FastAPI backend with SQLAlchemy; inspection of hidden directories revealed malicious Git hooks.
- The pre-commit hook contained a script that detected the operating system and silently executed a remote payload.
- The payload downloaded secondary scripts, installed Node.js, and ran an obfuscated parser with suspicious dependencies like clipboardy and hardhat, likely targeting crypto wallets.
- Attackers assigned unique IDs to track victims and used a decoy repository cloned from a public project.
- Scanning the attacker's server showed limited vulnerabilities but confirmed the operation was a widespread malware campaign.