--- title: How a Senior DevOps Interview Became a Sophisticated... description: A developer shares their experience with a sophisticated phishing attack disguised as a legitimate job interview for a Senior DevOps Engineer position at... canonical: https://daily.dev/posts/how-a-senior-devops-interview-became-a-sophisticated-hacking-attempt-uvl51hgin twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How a Senior DevOps Interview Became a Sophisticated Hacking Attempt | daily.dev og:description: A developer shares their experience with a sophisticated phishing attack disguised as a legitimate job interview for a Senior DevOps Engineer position at... og:url: https://daily.dev/posts/how-a-senior-devops-interview-became-a-sophisticated-hacking-attempt-uvl51hgin og:image: https://api.daily.dev/og/posts/uVl51HGiN.png og:image:alt: How a Senior DevOps Interview Became a Sophisticated Hacking Attempt og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How a Senior DevOps Interview Became a Sophisticated Hacking Attempt **[Serdarcan Buyukdereli](https://daily.dev/sources/su5hqluae4wlrb1nahjtv)** · [@serdarbuyukdereli](https://daily.dev/serdarbuyukdereli) · 2 min read · 290 upvotes · 20 comments ## Summary A developer shares their experience with a sophisticated phishing attack disguised as a legitimate job interview for a Senior DevOps Engineer position at Revolut. The fake recruiter sent a technical task containing malicious Python code that would create admin users and establish remote server connections. The attack demonstrates how cybercriminals are exploiting recruitment processes to target developers with seemingly innocent coding challenges. ## Content Recently, a person named "James," presenting himself as an HR representative from Revolut, reached out to me on LinkedIn for a Senior DevOps Engineer position. He shared the position details and asked for my CV; everything seemed like a standard recruitment process. I sent my CV and told him my availability. "James" then mentioned that someone else from the HR team would contact me for an interview. About an hour before the scheduled interview, someone from a UK number (+44) contacted me via WhatsApp to confirm the time. The interview itself also started as a WhatsApp call. However, the interviewer's English was quite poor, and he struggled to even understand what I was saying. Because of this, he suggested we continue the interview by text on WhatsApp. He said he was impressed with what I explained in writing and sent me a 15-minute technical task. The task was as follows: "You’ll receive a basic Python-based system monitoring script. Please make the following changes: Add memory usage monitoring. Add a warning alert when CPU usage exceeds 50%. Run the script and send a screenshot of the output, along with the updated script files. Please try to complete the task within 10–15 minutes after receiving it." As I started reviewing the code, a function inside main.py caught my attention. This function decoded a base64-encoded string, downloaded a malicious file from a specified server, instantly created a user with administrative privileges on my local machine, and finally, used this to open a session to a remote server. At first, I thought, "Maybe they're just logging my actions on their server as proof of my work." But as I grew suspicious, I had an AI tool analyze the code. The analysis confirmed my suspicions: the code was extremely dangerous malware. I immediately blocked the person on WhatsApp. Afterwards, when I went to check on the "James" profile—the HR rep who had contacted me on LinkedIn—I discovered that he had already blocked me. My purpose in sharing this experience is to show that cyber-attackers are now using even seemingly legitimate recruitment processes as traps. This is proof of how creative sophisticated phishing attacks can get. Please be cautious and skeptical, even with the most innocent-looking requests. Thanks for reading. ## Community discussion Top comments from developers on daily.dev. **@traustitj** · 23 upvotes > This is probably one of the scariest stories I have read since I read the Shining as a teenager. I doubt most people would read the code they were sent, especially as they only gave him 10-15 minutes. Scary. **@akkitto** · 13 upvotes > This attack is simple to detect. > > 1. UK number is fine, but they really need to be from the UK. If they cannot speak English or only poorly, that's a huge red flag. > 2. No recruiter, even the cheap ones, would conduct such a conversation over text. They will always do it through voice. No exceptions. They would rather drop you than switch to text. > 3. Recruiters don't know anything and they won't give you any technical task whatsoever. They only ever talk with you. > > I hope, these three points will help others discerning attacks and immediately reporting them to the platform received and in the... **@mythobyte** · 11 upvotes > I had an experience, not as crazy as that one but I smelt fraud. This was from a head hunter. I sent them my resume/cv and they told me that the company was interested in interviewing me and I had to fill out this form. Just put it this way, the form looked like an altered credit application. **@id10terr0r** · 4 upvotes > This is next level insane! When there is an extreme sense of urgency it always makes me question the motives. Well done man! **@cristianc** · 4 upvotes > Social engineering at its best :) > As a lesson, should never ever run arbitrary code on your machine, even if it seems legit or coming from legit sources, as they might have been compromised. Example, I never run bash installers from the internet, not even the ones from github directly, unless thoroughly inspected. Otherwise, use VMs and containers. ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#devops](https://daily.dev/tags/devops), [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/how-a-senior-devops-interview-became-a-sophisticated-hacking-attempt-uvl51hgin) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/how-a-senior-devops-interview-became-a-sophisticated-hacking-attempt-uvl51hgin","headline":"How a Senior DevOps Interview Became a Sophisticated Hacking Attempt","text":"A developer shares their experience with a sophisticated phishing attack disguised as a legitimate job interview for a Senior DevOps Engineer position at Revolut. The fake recruiter sent a technical task containing malicious Python code that would create admin users and establish remote server connections. The attack demonstrates how cybercriminals are exploiting recruitment processes to target developers with seemingly innocent coding challenges.","url":"https://daily.dev/posts/how-a-senior-devops-interview-became-a-sophisticated-hacking-attempt-uvl51hgin","datePublished":"2025-08-14T11:30:46.276Z","dateModified":"2025-09-10T14:56:11.646Z","author":{"@type":"Person","name":"Serdarcan Buyukdereli","url":"https://daily.dev/serdarbuyukdereli","image":"https://media.daily.dev/image/upload/s--tTV8hAPq--/f_auto/v1778701721/avatars/avatar_Su5HqluAE4wLRb1naHjtv?_a=BAMAMiWQ0","description":"Senior Devops and Cloud Engineer\n","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":21380}},"image":"https://media.daily.dev/image/upload/s--Z6HBDG3K--/f_auto/v1755171047/posts/uVl51HGiN?_a=BAMClqZW0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":290},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":20}],"comment":[{"@type":"Comment","text":"This is probably one of the scariest stories I have read since I read the Shining as a teenager. I doubt most people would read the code they were sent, especially as they only gave him 10-15 minutes. Scary.","datePublished":"2025-08-15T09:16:39.279Z","url":"https://daily.dev/posts/uVl51HGiN#c-2XsMS1Z6n","author":{"@type":"Person","name":"Trausti Thor Johannsson","url":"https://daily.dev/traustitj","image":"https://lh3.googleusercontent.com/a/ACg8ocJP2b_9n1STHZ_YtevY9ZAgEvXSN3VB1Q3MGjNqcnfrsm5wjkhR=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":23}},{"@type":"Comment","text":"This attack is simple to detect.\n\nUK number is fine, but they really need to be from the UK. If they cannot speak English or only poorly, that’s a huge red flag.\nNo recruiter, even the cheap ones, would conduct such a conversation over text. They will always do it through voice. No exceptions. They would rather drop you than switch to text.\nRecruiters don’t know anything and they won’t give you any technical task whatsoever. They only ever talk with you.\n\nI hope, these three points will help others discerning attacks and immediately reporting them to the platform received and in the worst case scenario to the police or other government agencies.","datePublished":"2025-08-21T13:00:50.451Z","url":"https://daily.dev/posts/uVl51HGiN#c-6Ls3HUiEf","author":{"@type":"Person","name":"Daniel","url":"https://daily.dev/akkitto","image":"https://media.daily.dev/image/upload/s--FtwJqX4c--/f_auto/v1754900041/avatars/avatar_29TCpY2hJR72V3BlxPXzX?_a=BAMClqZW0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":13}},{"@type":"Comment","text":"I had an experience, not as crazy as that one but I smelt fraud. This was from a head hunter. I sent them my resume/cv and they told me that the company was interested in interviewing me and I had to fill out this form. Just put it this way, the form looked like an altered credit application.","datePublished":"2025-08-15T12:00:00.950Z","url":"https://daily.dev/posts/uVl51HGiN#c-NQgkJq5He","author":{"@type":"Person","name":"Geoff Slaven","url":"https://daily.dev/mythobyte","image":"https://media.daily.dev/image/upload/s--MmeTofU---/f_auto/v1732649163/avatars/avatar_TlPKIWsj0D7A082jcGYnq"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":11}},{"@type":"Comment","text":"This is next level insane! When there is an extreme sense of urgency it always makes me question the motives. Well done man!","datePublished":"2025-08-26T14:10:49.717Z","url":"https://daily.dev/posts/uVl51HGiN#c-6XJQ1oEv5","author":{"@type":"Person","name":"Dwain Botha","url":"https://daily.dev/id10terr0r","image":"https://media.daily.dev/image/upload/s--ZwLhI_HW--/f_auto/v1778047448/avatars/avatar_7BpZkLtcVFtfH6cuoS4pu?_a=BAMAMiWQ0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4}},{"@type":"Comment","text":"Social engineering at its best :)\nAs a lesson, should never ever run arbitrary code on your machine, even if it seems legit or coming from legit sources, as they might have been compromised. Example, I never run bash installers from the internet, not even the ones from github directly, unless thoroughly inspected. Otherwise, use VMs and containers.","datePublished":"2025-08-20T07:31:16.231Z","dateModified":"2025-08-20T07:42:10.654Z","url":"https://daily.dev/posts/uVl51HGiN#c-ZWlldmyly","author":{"@type":"Person","name":"Cristian C","url":"https://daily.dev/cristianc","image":"https://lh3.googleusercontent.com/a/ACg8ocIHDjfvRf4004qYyQV-8Z9JI_VGvKgZXAPta-Su6fKS3dDFIg=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/su5hqluae4wlrb1nahjtv","name":"Serdarcan Buyukdereli"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Serdarcan Buyukdereli","item":"https://daily.dev/sources/su5hqluae4wlrb1nahjtv"},{"@type":"ListItem","position":3,"name":"How a Senior DevOps Interview Became a Sophisticated Hacking Attempt"}]} ```