--- title: How I Almost Got Hacked By A 'Job Interview' | daily.dev description: A developer shares a close call with a sophisticated phishing attack disguised as a legitimate job interview. The scam involved a fake LinkedIn profile from a... canonical: https://daily.dev/posts/how-i-almost-got-hacked-by-a-job-interview--h744ue0mq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How I Almost Got Hacked By A 'Job Interview' | daily.dev og:description: A developer shares a close call with a sophisticated phishing attack disguised as a legitimate job interview. The scam involved a fake LinkedIn profile from a... og:url: https://daily.dev/posts/how-i-almost-got-hacked-by-a-job-interview--h744ue0mq og:image: https://api.daily.dev/og/posts/H744uE0Mq.png og:image:alt: How I Almost Got Hacked By A 'Job Interview' og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How I Almost Got Hacked By A 'Job Interview' **[Hacker News](https://daily.dev/sources/hn)** · 6 min read · 247 upvotes · 33 comments ## Summary A developer shares a close call with a sophisticated phishing attack disguised as a legitimate job interview. The scam involved a fake LinkedIn profile from a real company, a coding challenge containing obfuscated malware designed to steal crypto wallets and credentials, and professional social engineering tactics. The attack was discovered by using an AI assistant to scan the codebase for suspicious patterns before execution. The malware was embedded in server-side code with full Node.js privileges and connected to a remote payload that disappeared within 24 hours. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@ricktonoli** · 9 upvotes > Wow, that is an impressive phish I must say. Thanks for the heads up. I guess adopting a trust nothing, verify everything approach is the only way to be safe. > > Well done for dodging that, and thank you for sharing. **@fabianletsch** · 4 upvotes > Wow this is scary! **@flaviomoreira** · 3 upvotes > That was close call. Time to isolate the coding environment from the personal one. **@joncoe** · 2 upvotes > Nice one uncovering this and writing about it. This was really slick and I must say, I very well would have been tricked by this. **@micahnorwoodjordan** · 2 upvotes > a trait i've seen many great engineers have is a near-obsession about small details. in this case, the fact that the server's endpoint was encoded naturally reeks of a musky code smell. my initial thought seeing that is that either a newbie or bad actor wrote that logic, but before you even make that determination, you'd have to effectively find that needle in the haystack. wow 😳 lol i love how the function is commented with "Get cookie" as a blatant lie 💀 ## Similar posts on daily.dev - [Dev targeted by sophisticated job scam](https://daily.dev/posts/dev-targeted-by-sophisticated-job-scam-1c3sgwpf2) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#nodejs](https://daily.dev/tags/nodejs), [#malware](https://daily.dev/tags/malware), [#code-review](https://daily.dev/tags/code-review) [View this post on daily.dev](https://daily.dev/posts/how-i-almost-got-hacked-by-a-job-interview--h744ue0mq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How I Almost Got Hacked By A 'Job Interview'","url":"https://daily.dev/posts/how-i-almost-got-hacked-by-a-job-interview--h744ue0mq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-i-almost-got-hacked-by-a-job-interview--h744ue0mq"},"datePublished":"2025-10-15T15:46:39.362Z","dateModified":"2025-10-15T15:47:07.811Z","description":"A developer shares a close call with a sophisticated phishing attack disguised as a legitimate job interview. The scam involved a fake LinkedIn profile from a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/505ee8067dd7fa40b5254bb31c200db6?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/505ee8067dd7fa40b5254bb31c200db6?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":33,"discussionUrl":"https://daily.dev/posts/how-i-almost-got-hacked-by-a-job-interview--h744ue0mq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":247},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":33}],"keywords":"security,nodejs,malware,code-review","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"How I Almost Got Hacked By A 'Job Interview'"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/how-i-almost-got-hacked-by-a-job-interview--h744ue0mq","comment":[{"@type":"Comment","text":"Wow, that is an impressive phish I must say. Thanks for the heads up. I guess adopting a trust nothing, verify everything approach is the only way to be safe.\nWell done for dodging that, and thank you for sharing.","datePublished":"2025-10-22T23:53:22.270Z","dateModified":"2025-10-22T23:54:35.424Z","url":"https://daily.dev/posts/H744uE0Mq#c-G8xwGRYgw","author":{"@type":"Person","name":"Rick Tonoli","url":"https://daily.dev/ricktonoli","image":"https://media.daily.dev/image/upload/s--1mKwVOZD--/f_auto/v1745813607/avatars/avatar_54gVqSdbL9DajhGSKNFpY"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":9}},{"@type":"Comment","text":"Wow this is scary!","datePublished":"2025-10-21T07:17:05.782Z","url":"https://daily.dev/posts/H744uE0Mq#c-8cQ0b7kai","author":{"@type":"Person","name":"Fabian Letsch","url":"https://daily.dev/fabianletsch","image":"https://lh3.googleusercontent.com/a/ACg8ocKR6BVy_wn23EoOKq7-BlszlcXcLmASlnb7l-GtS-q1bePnkaJf=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4}},{"@type":"Comment","text":"That was close call. Time to isolate the coding environment from the personal one.","datePublished":"2025-10-26T17:35:11.998Z","url":"https://daily.dev/posts/H744uE0Mq#c-jwsOeLiOQ","author":{"@type":"Person","name":"Flavio Moreira","url":"https://daily.dev/flaviomoreira","image":"https://avatars.githubusercontent.com/u/34199219?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3}},{"@type":"Comment","text":"Nice one uncovering this and writing about it. This was really slick and I must say, I very well would have been tricked by this.","datePublished":"2025-10-24T13:40:55.222Z","url":"https://daily.dev/posts/H744uE0Mq#c-URdmDzsYw","author":{"@type":"Person","name":"joncoe","url":"https://daily.dev/joncoe","image":"https://avatars.githubusercontent.com/u/3487906?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"a trait i’ve seen many great engineers have is a near-obsession about small details. in this case, the fact that the server’s endpoint was encoded naturally reeks of a musky code smell. my initial thought seeing that is that either a newbie or bad actor wrote that logic, but before you even make that determination, you’d have to effectively find that needle in the haystack. wow 😳 lol i love how the function is commented with “Get cookie” as a blatant lie 💀","datePublished":"2025-11-01T23:37:32.259Z","url":"https://daily.dev/posts/H744uE0Mq#c-XG4f3Yqg4","author":{"@type":"Person","name":"Micah Norwood","url":"https://daily.dev/micahnorwoodjordan","image":"https://media.daily.dev/image/upload/s--F7AsERgm--/f_auto/v1744468090/avatars/avatar_RkUh6L39HXCnFFgzyIq88"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}}]} ```