Fake job offers give attackers a way into a company through its developers. A believable recruiter, a live video call and a coding assignment are enough to get malicious code running on a work laptop. For engineers and hiring managers, checking who is really on the other side of a hiring process is now part of security.

This affects two groups. Developers with access to production systems, deployment tools or financial infrastructure are the most attractive targets. Hiring managers carry the other half of the risk, because their process decides what a candidate is asked to download, run or share.

The attacker does not hack the company first. They approach one employee as a recruiter, build trust over a few conversations, and then ask for one small action: run this assignment. That action puts the attacker's code on a machine that already has access.

Reported incidents at large crypto and fintech firms show how far this can go. In cases like these, a staged interview process has led to the theft of very large sums in digital assets.

The final theft phase can take just a few hours. The preparation takes much longer.

That is the pattern to understand. A developer's laptop is rarely the goal. It is the first step toward credentials, internal tools and signing systems. One compromised workstation can reach a lot further than the person who owns it.

A fake recruiter process looks like a normal one, and that is the point. It has a first call, a second call with someone senior, and a technical task at the end. Each step is designed to lower your guard.

In reported cases, the contact comes through a legitimate job-search platform. The first interview is with a supposed HR representative and the second with a supposed senior executive. Both can take place on live video. Attackers also use details from the target's social media to build rapport.

"First-round interview with a fake HR rep on a live video call", followed by a second interview with a supposed executive. Source: pattern described in media coverage of such incidents.

The request that matters comes last. The engineer is asked to download an assignment from a code repository onto a work computer. It contains malware.

A polished profile, a friendly tone and a video call prove nothing. Attackers know that engineers are used to take-home tasks, and they use that habit.

One caveat: these details come from company accounts and press coverage of such incidents. Regulators and law enforcement do not always confirm every technical point, and the attribution to a state-linked group is an investigative assessment, not a court finding.

You can usually spot a fake recruiter by checking three things: the company, the person and the task. If one of them does not hold up independently of the conversation, stop and verify before you continue.

Here is what I would check as a recruiter who talks to engineers every day:

• The company. Look it up through official registries and its own domain. Do not use links the recruiter sent you.
• The person. Compare name, title, email domain and work history. Check whether the company's own site lists that person.
• The task. A legitimate employer can offer a browser-based test, a plain-text exercise or an isolated sandbox. You should not need to run unknown code to show your skills.
• The pressure. Be careful with urgency, secrecy, or a sudden move to an encrypted chat app.
• A second channel. Call or email the company on a number you found yourself.

Never run an assignment on a work device without a security review. Use a separate machine or a disposable environment, or decline.

Declining is fine. A real employer will understand.

Hiring managers can make fake job interview scams harder by treating the hiring process as a security control. Every recruiter identity should be verifiable, every technical task should run in an isolated environment, and no candidate task should touch internal systems.

In practice that means a few concrete rules:

• Recruiters contact candidates from company-controlled domains and link to a real vacancy on the official careers page.
• Technical exercises run in a browser or a monitored sandbox, never on production machines.
• Nobody is asked to execute an unknown repository on a corporate laptop. Exceptions need written approval.
• HR keeps a list of approved interviewers, so a candidate can check who they are meeting.
• Developer workstations hold short-lived credentials, so one infected laptop does not open everything.

Employees also need a safe way to report a suspicious approach. If people fear blame, they stay quiet, and the attacker keeps their head start. Early reports allow early containment.

There is a cost side too. Too many hurdles put off genuine candidates, and senior engineers have options. The answer is not to drop take-home tests. Move them into a safe environment and make verification easy for both sides.

Recruiters now have to prove they are real. Engineers have become more careful, and they are right to be. A recruiter who cannot explain the role, the team and the process in detail looks exactly like a scam.

That changes how we work at Doghouse. In our Delivery Sprint, the intake, sourcing and interview steps are visible to the candidate from the start. You know who you will speak to, what each step covers and what is expected of you. Roles are real and public, like this senior Python developer position, so a candidate can check the context before sharing anything.

For leadership roles the same applies. A hiring manager approaching a developer should be able to point to a live vacancy, such as an engineering manager role, and to named people who are part of the process.

Data matters as well. CVs, interview recordings and identity documents are personal data under the GDPR. Keep only what you need, limit who can see it and set retention periods. The EU rules on cyber resilience, such as NIS2, are also pushing companies to treat hiring, tooling and infrastructure as one connected risk chain.

Nothing here is complicated. It is discipline, applied at every step.

Fake job offers work because they look like something engineers deal with every week. The defense is practical: verify the company, the person and the task, and keep candidate work away from company systems. Hiring managers who build this into their process protect their people without making the experience harder for real candidates.

If you are a developer who wants a recruiter who explains each step, or a hiring manager who wants a process you can inspect, talk to the team at Doghouse.

1. Binance investigation uncovers fake job plot involved in $9 billion crypto-heist
2. Binance: Fake Job Interviews, Malicious Code Used in Theft
3. Binance says fake job interview led to $6.3 billion crypto heist
4. Binance: hackers kwamen binnen via nepsollicitatie
5. Fake job interview behind $9bn Binance heist puts hiring on notice
6. Fake job interview behind US$6.3bn Binance heist puts hiring on notice

Written by our AI, read by a flesh-and-blood recruiter.