Fake Recruiter Schemes on LinkedIn Deploy Cross‑Platform RATs Through Coding Tests

Security analysts have identified a fresh phishing operation that targets software engineers with counterfeit employment offers on professional networking sites. The scheme turns ordinary coding challenges into a delivery vector for remote‑access malware, allowing threat actors to gain control of a developer's workstation once the test project is executed.

According to the investigation, the attackers masquerade as talent scouts on LinkedIn and comparable job boards, reaching out to prospective candidates with seemingly legitimate job descriptions. After an initial exchange, victims are asked to download a zip file containing a sample coding assignment. The package appears to include standard source files, but hidden within is a malicious payload that activates when the code is compiled or run.

Technical analysis revealed that the payload is a cross‑platform Remote Access Trojan capable of operating on Windows, macOS and Linux environments. The malware leverages common development tools and libraries to evade detection, employing code obfuscation and dynamic loading techniques. Once installed, it establishes an encrypted channel to a command‑and‑control server, enabling attackers to exfiltrate files, capture keystrokes, and execute arbitrary commands.

The ramifications extend beyond the individual developer. Compromised machines can become entry points for broader corporate breaches, especially in organizations that integrate personal devices into their development pipelines or use shared repositories. Theft of proprietary source code, intellectual property, and authentication tokens could undermine product security and give adversaries a foothold in the software supply chain.

Social engineering through bogus job offers is not new; however, this campaign marks a shift toward leveraging the trust developers place in recruitment processes and the routine nature of coding tests. Platforms such as LinkedIn have begun to flag suspicious recruiter profiles and warn users about unsolicited file transfers, but the rapid creation of new accounts and the use of generic messaging make complete eradication difficult.

Experts advise developers to verify recruiter identities through official company channels, avoid downloading executable code from unknown sources, and run any received files within isolated environments or sandbox tools. Organizations are urged to educate their engineering staff about these tactics, enforce strict policies on external code execution, and deploy endpoint detection solutions that can spot anomalous behavior. As attackers continue to refine their lures, vigilance across both personal and corporate layers will be essential to stem the tide of such deceptive intrusion attempts.