Risk & Threat Index

The Risk & Threat Index for your job search. We index Who’s reaching out — and flag the scams before you reply. A venture.

[Risk & Threat Index @RTindex]

"Clone this repo and run it locally before the technical round."

If you hear this in an interview, the interview is the scam.

This week many devs are sharing the same story: flattering DM, real-sounding blockchain project, a rushed call, and then a repo you have to run "quickly". Some walked away. Many don't.

Here's what's actually going on, and how to protect yourself 👇

━━━━━━━━━━

🎯 What is this attack?

It's known as Contagious Interview. The fake recruiter isn't hiring. The job is only the delivery method.

The repo looks like a normal take-home task, a dashboard, a DeFi app, an API. But hidden inside is code that runs when you type npm install or npm start.

It quietly collects:
• SSH keys
• Crypto wallets and seed phrases
• Browser passwords and session cookies
• AWS, GitHub and npm tokens
• Your .env files
Then it sends everything to the attacker. No pop-up, no warning. The code "works", so you don't suspect anything.

━━━━━━━━━━

🚩 Red flags we see again and again

• Flattering first message: "your profile really impressed us"
• Big salary, vague role, crypto or Web3 project
• Pressure to move fast, "run it before the next round"
• "Camera issues", voice-only call, or a face that glitches when you ask something unexpected
• Recruiter email with random numbers: name214@gmail instead of name@company
• Repo on Bitbucket or a brand-new GitHub account
• postinstall or prepare scripts in package.json
• Code far longer than the task needs, with the real payload hidden hundreds of lines down
If you see two of these together, stop.

━━━━━━━━━━

🛡️ Before you run any interview code

• Never run it on your main laptop. Use a throwaway cloud VM or container with no credentials in it.
• Read package.json first, especially the scripts section.
• Search every file for URLs, base64 strings, eval, new Function and child_process.
• Scan the repo before it touches your machine. That's why we built RTIdx.
• Ask the company for a video call with more than one person. Real teams don't mind.

━━━━━━━━━━

🚨 Already ran it?

Don't panic, but move fast:

• Disconnect that machine from the network
• From a clean device, move crypto funds to a brand-new wallet
• Rotate SSH keys and all API tokens: AWS, GitHub, npm, Stripe
• Log out of all browser sessions and change passwords
• Report the repo, so the next person gets warned

━━━━━━━━━━

💡 Why we built Risk & Threat Index

Some of us on the team were targeted by exactly these scams. One of us only escaped because he ran the "task" on a cloud instance instead of his laptop.

The same repos and fake recruiter personas get reused across many victims. When one person reports it, everyone else can be warned. That's the whole idea behind RTIdx: a community threat index for recruitment scams.

Paste a repo link, get a risk verdict in about 2 minutes. Free.

Link in the reply 👇

#ContagiousInterview #CryptoJobScam #JobSeekerSafety

[Costa @costa__io]

Had an "interview" for a blockchain project last week.

Camera was on, we're chatting, and the guy tells me to clone a GitHub repo and run it locally before we go further into the technical round.

I said sure, but first can you do me a favor

hold up 3 fingers in front of your face for me real quick.

He froze.

Didn't move.

Just sat there for a few seconds before the call cut off and he blocked me.

That's when I knew. A real interviewer doesn't glitch out over a random ask like that. A deepfake/AI overlay does.

These "run this repo" scams are getting scary common in crypto and dev hiring right now.

The setup is always the same:

- flattering DM
- real-sounding project
- rushed timeline
- a "quick step" before the call

that's really just remote access or a credential stealer in disguise.

If someone wants you to run code or install something before you've even had a real conversation, that's the whole scam.

Trust the instinct. Stay safe out there.

[Devendran @devendranmkm]

Day 2 at #Devcon8.

@Payaion : send a file, get paid, only the right person can open it. USDC on Base, for people and AI agents.

@RTindex: check the code before you run it. Stops fake-recruiter attacks on devs.

At Devcon? Let's talk. Links below.

[Risk & Threat Index @RTindex]

@T3chFalcon If you want to watch the simulation of how does it look: https://t.co/0LvjmZ5GaT

[Risk & Threat Index @RTindex]

@T3chFalcon Exactly what we have in our research database, various fake interviews scenarios. Very common and very dangerous

[Dark Web Intelligence @DailyDarkWeb]

⚠️ UPDATE: UNIT 42 CONFIRMS PHP2SHELL EXPLOITATION WITH AGENTIC AI POST-EX

Unit 42's Oct 23 threat-brief update confirms PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is being exploited in the wild, with attackers using agentic AI platforms for post-exploitation. Both flaws are unauthenticated RCE, CVSS 9.2 (CVSS 4.0).

In one European government case, within ~2 hours of initial exploitation attackers:
• Accessed password hashes and MFA secrets
• Stood up an NTLM-relay tunnel into Active Directory
• Attempted Domain Admin privilege escalation

Commands were wrapped in machine-parseable delimiters such as ==SHELLUSER== and ==PASSWD== — strong agentic-attacker markers. Cortex Xpanse still sees ~22.6M exposed PHP instances potentially vulnerable.

Not framed as a mass outbreak, but confirmed live post-ex. Patch PHP immediately (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or vendor fixed builds) and hunt for post-exploitation activity.

https://t.co/EwSJFbLUA7
#DDW #PHP2Shell #PHP #Unit42 #CyberSecurity #ThreatIntelligence #Vulnerability

[Risk & Threat Index @RTindex]

Scan any interview repo before running it:
🔗 https://t.co/oZ1BLjcNDi

From the terminal:
npx @rtidx/cli check <repo-url> --context recruiter

Got a suspicious repo or recruiter? Report it. It helps the next dev.

[Risk & Threat Index @RTindex]

"Clone this repo and run it locally before the technical round."

If you hear this in an interview, the interview is the scam.

This week many devs are sharing the same story: flattering DM, real-sounding blockchain project, a rushed call, and then a repo you have to run "quickly". Some walked away. Many don't.

Here's what's actually going on, and how to protect yourself 👇

━━━━━━━━━━

🎯 What is this attack?

It's known as Contagious Interview. The fake recruiter isn't hiring. The job is only the delivery method.

The repo looks like a normal take-home task, a dashboard, a DeFi app, an API. But hidden inside is code that runs when you type npm install or npm start.

It quietly collects:
• SSH keys
• Crypto wallets and seed phrases
• Browser passwords and session cookies
• AWS, GitHub and npm tokens
• Your .env files
Then it sends everything to the attacker. No pop-up, no warning. The code "works", so you don't suspect anything.

━━━━��━━━━━

🚩 Red flags we see again and again

• Flattering first message: "your profile really impressed us"
• Big salary, vague role, crypto or Web3 project
• Pressure to move fast, "run it before the next round"
• "Camera issues", voice-only call, or a face that glitches when you ask something unexpected
• Recruiter email with random numbers: name214@gmail instead of name@company
• Repo on Bitbucket or a brand-new GitHub account
• postinstall or prepare scripts in package.json
• Code far longer than the task needs, with the real payload hidden hundreds of lines down
If you see two of these together, stop.

━━━━━━━━━━

🛡️ Before you run any interview code

• Never run it on your main laptop. Use a throwaway cloud VM or container with no credentials in it.
• Read package.json first, especially the scripts section.
• Search every file for URLs, base64 strings, eval, new Function and child_process.
• Scan the repo before it touches your machine. That's why we built RTIdx.
• Ask the company for a video call with more than one person. Real teams don't mind.

━━━━━━━━━━

🚨 Already ran it?

Don't panic, but move fast:

• Disconnect that machine from the network
• From a clean device, move crypto funds to a brand-new wallet
• Rotate SSH keys and all API tokens: AWS, GitHub, npm, Stripe
• Log out of all browser sessions and change passwords
• Report the repo, so the next person gets warned

━━━━━━━━━━

💡 Why we built Risk & Threat Index

Some of us on the team were targeted by exactly these scams. One of us only escaped because he ran the "task" on a cloud instance instead of his laptop.

The same repos and fake recruiter personas get reused across many victims. When one person reports it, everyone else can be warned. That's the whole idea behind RTIdx: a community threat index for recruitment scams.

Paste a repo link, get a risk verdict in about 2 minutes. Free.

Link in the reply 👇

#ContagiousInterview #CryptoJobScam #JobSeekerSafety

[Costa @costa__io]

Had an "interview" for a blockchain project last week.

Camera was on, we're chatting, and the guy tells me to clone a GitHub repo and run it locally before we go further into the technical round.

I said sure, but first can you do me a favor

hold up 3 fingers in front of your face for me real quick.

He froze.

Didn't move.

Just sat there for a few seconds before the call cut off and he blocked me.

That's when I knew. A real interviewer doesn't glitch out over a random ask like that. A deepfake/AI overlay does.

These "run this repo" scams are getting scary common in crypto and dev hiring right now.

The setup is always the same:

- flattering DM
- real-sounding project
- rushed timeline
- a "quick step" before the call

that's really just remote access or a credential stealer in disguise.

If someone wants you to run code or install something before you've even had a real conversation, that's the whole scam.

Trust the instinct. Stay safe out there.

[Risk & Threat Index @RTindex]

Scan any interview repo before running it:
🔗 https://t.co/oZ1BLjcNDi

From the terminal:
npx @rtidx/cli check <repo-url> --context recruiter

Got a suspicious repo or recruiter? Report it. It helps the next dev.

[Risk & Threat Index @RTindex]

@Sambhav_Gandhi For anyone who gets a similar "clone and run" task, you can check it here before running: https://t.co/oZ1BLjcNDi
Or from the terminal: npx @rtidx/cli check <repo-url> --context recruiter

[Risk & Threat Index @RTindex]

@Sambhav_Gandhi This is the right habit 👏 Scan first, run never (at least not on your own laptop).
Did you save the repo link? These repos get reused across many fake "recruiters". If it's reported, the next dev who gets the same one can be warned. That's what we're building at RTIdx.

[Risk & Threat Index @RTindex]

If anyone gets a "just clone and run this" task, please don't run it on your laptop. Scan it first:

npx @rtidx/cli check <repo-url> --context recruiter

or paste it at https://t.co/6eaqvl8CKh

Our Research Paper (Public Access): https://t.co/3dOQzYCOQa
(Presented at ARES 2026 in Linköping, Sweden; paper starts on page 312)

[Risk & Threat Index @RTindex]

The 3-finger test is smart 👏 A hand in front of the face still breaks most live face-swap tools. Same thing happened to me. They said "camera issues" and kept it voice-only. We study this at @RTindex and co-wrote a research paper with Stony Brook on how these job scam gangs operate.

[Risk & Threat Index @RTindex]

Thank you @thedefdone for writing a detailed blog post 🙏

[Risk & Threat Index @RTindex]

Your "final round" repo might be reading your SSH keys.

Postinstall scripts fire the moment you run npm install — before you've read a line of the actual task. That's the usual trigger for the pattern researchers call "Contagious Interview."

We just shipped a free CLI that checks a repo before you run it: lifecycle hooks, obfuscated payloads, known exfil patterns — all static analysis, nothing executes.

@defdone wrote up the full six-flag checklist. Link + a demo of the tool below.

[Risk & Threat Index @RTindex]

https://t.co/bs5PbHHitU

See a demo: https://t.co/mcRRsKzupE

[Risk & Threat Index @RTindex]

The scariest line in this report: candidates were told one file was "bug-free, don't touch it." That's exactly where the payload was.

The trojanized package was never even published to npm — bundled straight into node_modules, so a registry check comes back clean. Then it persists via fake VS Code extensions, cron jobs, Git hooks, and Azure-hosted C2.

We've had teammates nearly hit by this exact playbook (part of why we started https://t.co/6eaqvl8CKh as a side project — a way to sanity-check a repo link before running anything from a "coding challenge").

If you're job hunting right now, read every file, especially the one you're told to skip.

[Risk & Threat Index @RTindex]

RTIdx is onsite at ARES 2026, Sweden. It’s a security conference and we are here with our paper about scams in job recruitment: „From Fake Job Offer to Full Environment Compromise: Anatomy of the Contagious Interview Campaign”

[defdone.com @thedefdone]

Check out our research project - https://t.co/4qtl86mD9y We've teamed up with @stonybrooku to fight the fake job recruitments scams that are plaguing services like @LinkedIn

It's free to use, fully anonymous, and by submitting your case you're helping us to build better measures to prevent it happening to others.

[Risk & Threat Index @RTindex]

RTidx Research Blog - https://t.co/FjwYUToA9H

OXIL Research Paper - https://t.co/sB9CvuT1dj

[Risk & Threat Index @RTindex]

1/ Two teams. Two unrelated datasets. Same scam pattern.

We analyzed 6 malicious repos used in fake developer job offers. A separate 28.6M-signal study from OXIL, unconnected to our research, found almost the exact same thing.

Thread 🧵

[Risk & Threat Index @RTindex]

8/
Full technical writeup, IOC list, and indicator matrix 👇 (link in reply)