Fake job interviews used to deliver malware and drain crypto savings

Microsoft's Defender Experts team documented a cyberattack campaign called Contagious Interview, active since at least December 2022, in which threat actors impersonate recruiters from crypto or AI firms to target job seekers. The attack is designed to reach the technical assessment stage, where candidates are socially conditioned to run unfamiliar code without suspicion. Victims are typically instructed to clone and execute a malicious NPM package from seemingly legitimate platforms like GitHub or GitLab. In one case reported by BBC World Service on 4 September 2026, a UK job seeker lost £18,000 in cryptocurrency savings within hours of completing such an assessment. Microsoft advises that no legitimate employer requires candidates to run unknown code on personal machines, and recommends using isolated virtual environments for coding tests.