---
title: "I Almost Ran Malware from a Fake LinkedIn Recruiter"
description: "Fake recruiter, fake repo, real malware. A step-by-step teardown of a LinkedIn scam"
pubDate: "2025-12-07"
lang: "en"
slug: "i-almost-ran-malware-from-a-fake-linkedin-recruiter"
url: "https://hoangyell.com/i-almost-ran-malware-from-a-fake-linkedin-recruiter/"
author: "HoangYell"
translation_vi: "https://hoangyell.com/vi/i-almost-ran-malware-from-a-fake-linkedin-recruiter/"
categories: ["Life"]
tags: ["malware", "linkedin"]
heroImage: "https://raw.githubusercontent.com/HoangGeek/store/main/webp/photo-1598500229528-391c3d2c1fae.webp"
---

<iframe data-testid="embed-iframe" style="border-radius:12px" src="https://open.spotify.com/embed/episode/73Olh2JHsSNL0d45qf59up/video?utm_source=generator" width="100%" height="351" frameBorder="0" allowfullscreen="" allow="autoplay; clipboard-write; encrypted-media; fullscreen; picture-in-picture" loading="lazy" title="open.spotify.com embed"></iframe>

**The DM That Started It All 💼**

There I was, scrolling through "Threads city" office edition like any other day, checking the latest news, drama, and farewells.

Then this chump slides into my DMs:

![Image](https://raw.githubusercontent.com/HoangGeek/store/main/webp/jefferson-vinicius-87a826191.webp)

[**Jefferson Vinícius**](https://www.linkedin.com/in/jefferson-vin%C3%ADcius-87a826191/) - Brazilian profile, zero connection to Livepeer anywhere. Probably stole someone's avatar, but still looks like a clown:

> "Hey! Livepeer is offering a monthly salary of 15–20k USD with flexible working hours and fully remote. Are you interested?"

Had to read that twice.

**$15-20k. Per month. Remote. Work whenever you want.**

![Image](https://media2.giphy.com/media/Evp4SYXEt5oly/giphy.gif)

I knew Livepeer - legit crypto video infrastructure company. Almost bought their token during one of those FOMO bull runs.

But... $20k/month?! That's FAANG guru money, and they're recruiting ME, some random dude named HoangYell?
That's like inviting a local league player to carry Liverpool!

Smells like BS. But hey, those self-help books always say "seize opportunities." Maybe the universe is blessing me? Or maybe crypto companies just throw money around? Let's play along. Sometimes even a blind dog catches a bone...

***

## Red Flag #1: The Time Zone Fiasco ⏰

He says there's a technical assessment. Cool, I've done a hundred of these. I schedule **2:00 UTC on Saturday**.

He agrees instantly. No "let me check my calendar." Just "OK!"

His profile says Brazil. Brazil is UTC-3. Quick math: 2:00 UTC = **11 PM Friday night** over there.

Either this guy's the most dedicated recruiter in human history, or... he ain't in Brazil.

I even [asked ChatGPT](https://chatgpt.com/share/692c441f-bd70-800d-ba86-dc4a556e179f) if the profile looked legit. It gave some wishy-washy answer. Basically useless.

![Image](https://media4.giphy.com/media/3RhQpiBbHYJyQP74la/giphy.gif)

***

## Red Flag #2: Vanished Without a Trace 👻

Saturday arrives. I message him at 2:00 UTC: "Ready to go!"

*Silence.*

Wait. Grab coffee. Pee & poop. Come back. Still nothing.

**12 hours later**, he drops a link like nothing happened:

> "Here's the assessment: `https://bitbucket.org/livepeer-labs/technical-assessment`"

No apology. Nothing. Just casually drops the link.

Recruiting for a **$20k/month position** with this level of professionalism... 🤡

> **Pro tip:** Scammers are terrible at pretending to be normal humans.

![Image](https://media4.giphy.com/media/fBEMsUeGHdpsClFsxM/giphy.gif)

***

## Red Flag #3: Why Bitbucket Though? 🎣

Livepeer's real repos? [github.com/livepeer](https://github.com/orgs/livepeer/repositories) - over 200 of them, all on GitHub.

But their "technical assessment"? Hosted on some random Bitbucket account. *Yeah, sure, totally legit.* 🙄

> ⚠️ **WARNING**
>
> This repo contains actual malware. Don't run it unless you enjoy letting strangers party in your machine.
>
> (Original repo got nuked. [Here's my fork](https://bitbucket.org/hoang-yell/example-trojan-project-received-via-linkedin/src/main/) if you wanna see the crime scene.)

![Image](https://media0.giphy.com/media/PLFUhxdKbAAEM/giphy.gif)

***

## Red Flag #4: "Just Clone and Run It" 🚨

He told me to pull the repo and run it locally for the assessment.

I've done tons of coding challenges. **Never** has a legit company said "just download our mystery code and execute it, trust me bro."

Real companies use:
- Simple task descriptions: "Build X from scratch"
- Online IDEs (HackerRank, CodeSignal)
- Their own platforms

Nobody says "just run this random project on your machine, trust me bro!"

That's not a test. **That's a delivery mechanism for sketchy stuff.**

![Image](https://media0.giphy.com/media/3o7qE4hinbJvjsgGxW/giphy.gif)

***

## Red Flag #5: The Assessment Makes Zero Sense 🎭

The task:
> "When you stop recording, display the canvas drawing as a video."

Neat frontend challenge. One problem: **my entire profile screams backend developer.** APIs, databases, system design. CV? Backend. Projects? Backend.

They didn't read anything. They just needed a warm body to run `npm install`.

Seriously, are these people stupid? Giving a frontend task to a backend dev?

![Image](https://media2.giphy.com/media/R51a8oAH7KwbS/giphy.gif)

I had two choices:
1. Run it on my main machine like an idiot
2. Be suspicious right now

I chose to be suspicious. Fired up my **sandbox laptop** - the one with cracked games, shady downloads, and literally nothing I care about. If they wanna steal something, they can have my CS 1.6 saves from 2008.

***

## Red Flag #6: WTF Is `execp` Doing Here? 🔍

First thing I did: check `package.json`.

A simple canvas app should have basic dependencies. But this one had:

![Image](https://raw.githubusercontent.com/HoangGeek/store/main/webp/lib.webp)

**`execp`** - a module for *executing system commands*.

In. A. Canvas. Drawing. App.

Why would a basic frontend app need to run system commands?

**The stench is getting stronger.**

***

## AI Caught It Instantly 🤖

I asked [Google's new shiny assistant](https://antigravity.google/): "tell me what this does."

Response:

> "Yeah, this is malware. Here's what it's doing..."

Not "interesting project." Not "looks normal." Straight up: **malware.**

***

## The Reveal: Hundreds of Hidden Lines 🧬

Opened `next.config.js`. Looked innocent:

![Image](https://raw.githubusercontent.com/HoangGeek/store/main/webp/scam_script_without_word_wrap.webp)

Then I turned on **word wrap**.

Holy. Shit.

![Image](https://raw.githubusercontent.com/HoangGeek/store/main/webp/scam_script_with_word_wrap.webp)

What looked like 5 lines was actually **hundreds** of obfuscated JavaScript crammed onto single lines. Classic trick.

After deobfuscation, here's what the malware does:
- Phones home to `http://45.43.11.248:1244`
- Fingerprints victim machine (username, hostname)
- Downloads next-stage malware
- Hides it in `~/.vscode/` to look legit
- Executes the payload
- Retries every 10 minutes if it fails

```text
               ┌────────────┐
               │   START    │
               └─────┬──────┘
                     │
          ┌──────────┴──────────┐
          │ Decode obfuscated   │
          │ strings and modules │
          └──────────┬──────────┘
                     │
          ┌──────────┴──────────┐
          │ Fingerprint machine │
          │ Phone home to C2    │
          └──────────┬──────────┘
                     │
          ┌──────────┴──────────┐
          │ Download payload    │
          │ Hide in ~/.vscode/  │
          └──────────┬──────────┘
                     │
          ┌──────────┴──────────┐
          │ Execute payload     │
          │ Retry every 10 min  │
          └─────────────────────┘
```

The repo was just step one. A delivery boy. The real damage would come from whatever gets downloaded next.

Welp, I get it now. There's no gold falling from the sky. Just bird shit and rain.

***

## I Trolled Him Back a Little 😈

I told Jefferson I was done, asked if I should submit a PR.

His response? He didn't care about the code at all. He wanted **a video of the app running** - proof that I'd executed his package.

You think you can scam me? Bitch, nice try, idiot. 😏

I didn't send anything. Went silent.

I was planning to send him this blog post to "evaluate my assessment." Shame he disappeared from LinkedIn before I could finish writing. What a loss. 🤷

![Image](https://media3.giphy.com/media/l2qJnXbUzQAeY/giphy.gif)

***

## TL;DR: The Red Flags 🚩

| # | Red Flag | Why It's Sus |
|---|----------|--------------|
| 1 | **Sloppy timing** | Agrees to 11 PM Saturday his timezone, then ghosts for 12 hours |
| 2 | **Hosting mismatch** | Real company uses GitHub, "assessment" on random Bitbucket |
| 3 | **"Clone and run it"** | Nobody legit asks you to execute mystery code |
| 4 | **Wrong assessment type** | Frontend task for a backend dev? Nonsense |
| 5 | **`execp` in a canvas app** | System commands in a drawing demo? |
| 6 | **Obfuscated config** | Hundreds of hidden lines in `next.config.js` |

***

## What's This Attack Called? 🎓

Two classic techniques, one combo attack:

### 1. Spear Phishing 🎯

Regular phishing = spam 1,000 random people with "you won a prize" emails.

*Spear* phishing = targeted. This dude looked at my profile, saw "developer," and crafted a personalized message (Livepeer, remote, $20k). It's phishing with aim.

### 2. Trojan Horse 🐴

Remember the Greeks hiding soldiers inside a wooden horse as a "gift"?

This "Technical Assessment" repo is the Trojan. Looks like a normal coding challenge. Actually contains malware waiting to execute the moment you run `npm install`.

> **Quick cheat sheet:**

| Term | What It Is | Spreads By Itself? |
|------|------------|-------------------|
| **Malware** | Umbrella term for all bad software | - |
| **Virus** | Malware that self-replicates | ✅ Yes |
| **Trojan** | Malware disguised as legit software | ❌ No, YOU run it |

![Image](https://media4.giphy.com/media/3orieLmh9IpFN41vnq/giphy.gif)

***

## How to Not Get Owned 🛡️

1. **Use a sandbox.** VM, old laptop, whatever. Never run sus code on your main machine.
2. **Read `package.json` first.** Takes 30 seconds. Could save your ass.
3. **Trust your gut.** If it feels wrong, it probably is.
4. **No legit $20k offer dies** just because you refused to run some shady Bitbucket repo.

***

## What Actually Saved Me

No elite hacking skills here. Just:

- 🧠 Paranoia (healthy amount)
- 💻 A sandbox laptop I don't care about
- ⏱️ 30 seconds reading dependencies
- 🤖 AI to decode the obfuscated mess
- 🚶 Staying alert to too-good-to-be-true bait

Remember: **If it sounds too good to be true, it's 99% a scam.** Don't be greedy.

![Image](https://raw.githubusercontent.com/HoangGeek/store/main/webp/info.webp)