Malware in Fake Crypto Job Coding Tests
How fake crypto job coding test malware works, the warning signs in recruiter messages and take-home repos, safe ways to run tests and what to do if infected.
Fake crypto job coding tests are a malware attack in which a fake recruiter or company sends a job candidate a take-home project or technical task that contains hidden malicious code; when the candidate installs or runs it, the code steals wallets, passwords and credentials or installs a backdoor. The job, the company and often the interviewer are fabricated — the coding test is the delivery mechanism.
Developers are attractive targets because their machines tend to hold crypto wallets, private keys, cloud credentials and access to employer systems. Security researchers have publicly linked some of these campaigns to well-resourced, state-linked groups, so the lures can look highly professional. This guide explains how the attack works, what a realistic version looks like and how to protect yourself.
How the Attack Works, Step by Step
- 1First contact. A recruiter approaches you on a professional network, messaging app or job board with an attractive role at a crypto startup — often remote, well paid and urgent.
- 2Credibility building. You get a polished job description, a company website and sometimes a short call with a friendly "hiring manager." Profiles may be stolen or AI-generated.
- 3The test. You receive a link to a code repository or a ZIP file and are asked to fix a bug, add a feature or "just run it and review the architecture."
- 4Execution. The malicious part runs when you install dependencies or start the app. It may be a post-install script, a tampered package, or a line in a config file that downloads and executes a second-stage payload.
- 5Theft. The malware searches for browser wallet extensions, wallet files, saved passwords, cookies, SSH keys and environment files, sends them to the attacker and may install a remote-access tool.
- 6Cash-out. Funds are drained from your wallets, sometimes days later, and stolen work credentials may be used to attack your current employer.
A variation skips the repository: the interviewer claims their meeting software is not working and sends a link to a "fixed" video call app or driver, which is the malware. Our article Fake Browser Update and Captcha Malware Targeting Crypto Users expands on this point.
A Composite Example
The following is a hypothetical scenario combining common patterns, not a real case.
Imagine a backend developer, Sam, is contacted by a recruiter for a "senior blockchain engineer" role at a new DeFi startup. After a pleasant chat, Sam receives a private repository for a "staking dashboard" and is asked to fix a failing test within 24 hours. Sam clones it on his everyday laptop and runs the install command. The package file contains a post-install script that looks like a build step but fetches a hidden payload. The tests run fine, Sam submits his fix, and the recruiter goes quiet. A week later, Sam's browser wallet is emptied and his work cloud account shows logins from abroad.
Nothing in that story required Sam to "click a bad link." Running the code was enough. For a deeper look, see Scammers Impersonating Regulators and Police in Crypto.
Warning Signs Checklist
| Red flag | Why it matters |
|---|---|
| Unsolicited offer with unusually high pay and urgency | Pressure reduces careful checking |
| Recruiter or company has a thin, new or inconsistent online presence | Fake identities are cheap to create |
| Test must be run locally, quickly, with "npm install" or similar first | Execution is the goal, not your code review |
| Repository has few commits, a single contributor or obfuscated files | Malicious code is often hidden in minified or encoded lines |
| Unusual install, pre-start or post-install scripts | These run automatically |
| Request to install special meeting, assessment or driver software | A classic malware delivery method |
| Interviewer avoids video, or the "company" email domain is a free provider | Real companies usually use their own domain |
Our guide to fake crypto jobs and task scams covers other job-related fraud, and crypto scams on LinkedIn explains how recruiter impersonation works on professional networks. See also: Fake Crypto Charity and Disaster Donation Scams.
How to Protect Yourself
Before you run anything
- Verify the company independently. Find the company's official site yourself, check that the role is listed there and contact them through a published channel. See how to verify a website is the official project site.
- Read before you run. Open the package or build files and look for install scripts, unfamiliar dependencies and long encoded strings.
- Disable automatic scripts where your package manager allows it, so dependencies can't run code on install without your knowledge.
Isolate the environment
- Use a disposable virtual machine, container or cloud development environment.
- Make sure it has no wallets, seed phrases, password manager, SSH keys, cloud credentials or logged-in browser sessions.
- Delete it once the test is done.
Separate work from money
Keep crypto on a hardware wallet and avoid storing seed phrases or private keys on any computer you use for development. A dedicated device for crypto, separate from the one you use for experiments, sharply limits what a single infection can reach. Our guide on supply chain attacks explains why malicious dependencies are dangerous even in legitimate projects.
What to Do If You Ran a Suspicious Test
- 1Disconnect the device from the internet and stop using it for anything sensitive.
- 2From a clean device, move funds to new wallets with brand-new seed phrases. Don't reuse any seed phrase that was ever typed or stored on the infected machine.
- 3Change passwords and revoke sessions for email, exchanges, code hosting and cloud accounts, starting with email. Rotate API keys and SSH keys.
- 4Tell your employer's security team if any work credentials or code were on the device.
- 5Wipe and reinstall the operating system before reusing the computer.
- 6Report it. Report the fake recruiter profile to the platform, and the incident to local authorities. You can also report scam projects or domains through our submit a request page.
Our checklist what to do immediately if your wallet is compromised covers the recovery steps in more detail.
Bottom line
A fake crypto job coding test turns your own hands into the attacker's delivery system: the moment you install or run the project, hidden code can steal everything on your machine. Treat every unsolicited take-home task as untrusted code, verify the employer independently, run tests only in a clean disposable environment, and keep your crypto keys on a separate, dedicated device.
Frequently asked questions
How can a coding test install malware?
A take-home project is real code that runs on your computer. Attackers hide malicious code in a dependency, an install script, a configuration file or an obfuscated line in the project. When you install dependencies or start the app, that code runs with your user permissions and can steal wallet data, passwords and session cookies or install a backdoor.
Who is targeted by fake crypto job interviews?
Mainly software developers, especially those with crypto or Web3 experience, because their computers often hold wallets, private keys, API keys and access to company systems. Designers, community managers and other job seekers are also targeted with fake meeting apps or documents.
Is it safe to run a coding test in a virtual machine?
It is much safer than running it on your main computer, as long as the virtual machine or cloud workspace has no wallets, saved passwords, SSH keys or company access, and you delete it afterward. It does not make the job offer legitimate; it only limits damage if the code is malicious.
What should I do if I ran a suspicious coding test?
Disconnect the device, and from a different clean device move funds to new wallets with new seed phrases, change passwords, revoke sessions and API keys, and warn your employer if work accounts were exposed. Then wipe and reinstall the infected computer before using it again.