Contents
In short: twice in 2026, a fake "client" tried to get me to run their code. In June it worked: the test project hid malware in one of its npm dependencies, it ran for days, and no antivirus said a word. In October I refused. Both followed a playbook the FBI ties to North Korea; nobody has formally attributed my two cases, but they match it. The FBI's advice: don't run interview code on your work computer, use a separate virtual machine if you must, and verify who's hiring on another channel.
June: the test project was the malware
The full story is in my earlier post, Two fake Upwork jobs, one infected Mac. The short version: a "client" on a freelance site gave me a coding test.
"He sent over a Node.js test project called "Online_Store". The malicious code was hidden in one of its npm dependencies."
I didn't notice for a while: "By the time I noticed, it had been running in the background for days."
And nothing warned me: "neither macOS's built-in XProtect nor traditional antivirus made a sound, either time."
October: camera off, "install this meeting app"
Four months later, a new "client", this time from a fake firm. On the video call, "He kept his camera off". Then "we had to switch to a meeting app called "Zeff"", and to get it I was to "run a curl | bash command in the terminal, or download a DMG. I didn't install it."
The commands and addresses stay out of the video and this post: this is about spotting the lure, not about what it installs.
A known playbook
Looking back, the two attempts had the same shape: "Both attacks followed the same playbook: contact, build trust, the ask, the payload. The second time, I stopped at the payload."
That shape is one the FBI has warned about. Its public service announcement PSA 240903 is titled "North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks". My cases match the pattern it describes; no one has formally attributed them, so I don't claim North Korea hacked me.
Why it's aimed at people
Speaking to the BBC after the Binance hack, Mackenzie Jackson of Aikido described a shift. In the BBC's words: "He says hackers have shifted from going after company infrastructure to going after the machines of the people who run it."
And on how: "Jackson says techniques vary, but include tricking workers into installing malware under the pretext of a job interview, or interfering with code that developers rely on."
Jackson was describing common techniques, not saying how Binance was breached.
The red flags
The FBI lists this one among its indicators: "Requests to conduct a "pre-employment test" or debugging exercise that involves executing non-standard or unknown Node.js packages, PyPI packages, scripts, or GitHub repositories."
From my own two cases, two more: a "client" who keeps the camera off and wants to switch to an app you've never heard of, and a request to paste a command into your terminal.
The fix
- Not on your work computer. The FBI: "Avoid taking pre-employment tests or executing code on company owned laptops or devices."
- If code must run, keep it apart. The FBI's advice, summarised: use a virtual machine on a device that isn't connected to the company, or a device the tester provides.
- Verify on another channel. The FBI: "Develop your own unique methods to verify a contact's identity using separate unconnected communication platforms."
What I built afterwards
Afterwards, I made a tool: "So I built a small macOS menu bar app called Tsuba". The idea: "before unfamiliar code runs for the first time, it takes a look for you." Tsuba is free and open source. It comes after the habits above, not instead of them.
Sources
- Oliver Zhang, Two fake Upwork jobs, one infected Mac, oliverz.dev, 28 Oct 2026
- FBI, PSA 240903: North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks, 3 Sep 2024
- BBC News, live page on the Binance hack, 30 Oct 2026
The video is animated with code and the script was written with AI assistance; every fact above is checked against the sources. Illustrative: the project tree and the red dependency, the "no threats" shield, the video call and the redacted terminal command. This post explains the risk and the fix, not the steps of an attack. Made with Shotloop, my free Mac app for code-made explainers, fixed one shot at a time.