JFrog exposes fake interview campaign targeting developer machines

Binance says its October theft of about $6.34 billion from hot wallets began after an engineer in a fake interview scenario downloaded a take‑home task onto his work laptop. JFrog has since exposed a parallel operation, a front company called AccuraSoftHire with a Careers site, ads on Indeed and Glassdoor, recruiters with LinkedIn profiles, and a take‑home test that loads malware.

The investigation uncovers that two poisoned npm packages used by the task remained installable for five and seven months, only being replaced by npm’s security placeholder in mid‑November; npm recorded more than 4,000 downloads of those packages in 2026. The attackers’ server history is public via an Ethereum wallet, which decodes to eight servers, the latest posted on 19 October, and a loader that reads its next address from blockchain transactions.

The attack chain described by JFrog involves three main artefacts: a tainted take‑home test that loads a malicious Tailwind plugin, a camera “driver” delivered via a Windows/Mac/Linux installer that runs a JavaScript payload, and a browser extension loaded by hand from a folder called job-new-alerts that can register a native messaging host and set up a periodic contact with the attack site.

The loader, known as PolinRider, downloads stages from the attacker’s server, decodes and runs them, and is said to exfiltrate browser credentials, wallet data and credentials from version control among other data. Binance reports also detail additional North Korea–linked cases and warn that the same technique can infect machines via hijacked legitimate packages.

Defenders are urged to search for the implicated npm packages, take‑home task indicators, the eight server addresses and related artifacts, and to rotate credentials after any suspected infection.