A phishing scheme targeting software engineers uses fake LinkedIn job offers to distribute malware disguised as coding challenges. The attack begins when recruiters contact developers with part-time remote positions offering high hourly compensation. The initial contact is made under the name of a company unaware of the impersonation, and the coding test is provided without a preliminary introduction call.

The malicious TypeScript codebase contains approximately 180 files with calls to external endpoint https://api.jsonbin.io/v3/b/6a60970bf5f4af5e29b03d8d. This second-stage loader downloads 24,686 characters of obfuscated JavaScript that connects to Command & Control server at IP address 147.189.174.138. The payload includes modules for remote access, credential theft, and file exfiltration.

The malware can access SSH keys, AWS credentials, browser profiles, cryptocurrency wallet data, and .env files because these are all user-owned by design. On Windows systems, it enumerates all drive letters and scans mapped network drives. The RAT component actively fingerprints virtual machines using system_profiler, /proc/cpuinfo, and searches for vmware, qemu, and microsoft corporation identifiers.

Prevention strategies include using AI code scanning (though limited), Docker container isolation, or running tests in isolated virtual machines with snapshots restored afterward.