LinkedIn Fake Recruiting + Malicious Repo Poisoning: A Post-Mortem

Scammer’s LinkedIn profile: Derlys Cardozo

Tonight on LinkedIn I ran into a classic fake recruiting + malicious repository poisoning scam. The attacker impersonated Conduit, a well-known cross-border payments company, invited me to an interview, and dangled a high-paying remote role to trick applicants into cloning and running a malicious code repository — aiming to steal server keys, wallet credentials, API tokens, and other sensitive data via remote code execution (RCE).

This post walks through the full interaction, the attack mechanics, the scammer’s underlying logic, and practical triage steps — as a warning to fellow engineers.

---

I. Full Scam Timeline

The operation chained LinkedIn outreach, a Google Meet “interview,” and a poisoned Bitbucket repo. The pacing was tight and the disguise convincing — it closely mimicked a legitimate overseas tech hiring process.

1. Initial Contact: Impersonating a Real Company

A user named Derlys Cardozo DM’d me on LinkedIn, claiming to represent Conduit’s expanding engineering and product teams and looking for engineers with matching experience. The pitch sounded like a normal overseas recruiter outreach.

Hi Yuki,

I’m reaching out regarding an opportunity at Conduit as we continue expanding our engineering and product teams while building new initiatives across our core product lines.

We’re currently connecting with a small group of engineers and technical leaders whose experience may align with what we’re building. If you’re open to it, I’d be happy to share the full role details for your review.

Best regards,
Derlys

After I expressed interest, they immediately sent an attractive package: full-time and part-time remote roles — full-stack engineer, tech lead, technical PM, etc. — at $13,000–25,000/month, far above market rates. They also asked for my resume, tech stack, salary expectations, and portfolio — further mimicking a real hiring flow to lower my guard.

2. Tailored Resume Review: They Knew I Had a Security Background — and Still Pushed

After I shared my background and portfolio, they didn’t send generic praise. They called out my specific skills: cybersecurity, penetration testing, red teaming, Web3 development, quant research, independent product work — and said I was a strong fit for full-stack and Web3 roles.

Hi Yuki,

Thank you for sharing your background and portfolio. I had a chance to review your experience, and your mix of cybersecurity expertise, Web3 development, quantitative research, and independent product building really stood out.
Your work across penetration testing, red team operations, blockchain tooling, AI-assisted development workflows, and quantitative strategy research is especially impressive, along with the products and projects you’ve independently built and launched.
Based on your background, you seem like a strong potential fit for several of our current engineering tracks, particularly Full-Stack and Web3-focused initiatives.
Our team lead would love to set up a quick call with you today to learn more about your experience and discuss the opportunities in more detail.
What time are you available today?

This makes one thing clear: the group didn’t spam blindly — they read my profile carefully and knew I had real red-team and security experience. They still accelerated the interview and compressed my thinking time. That was deliberate.

We agreed on Google Meet. After a brief timezone mix-up, they sent a meeting link and kept pressuring me to join.

3. The Interview Trap: “Run the MVP Locally” as a Security Litmus Test

In a ~15-minute video call, they briefly described a chaotic multi-team project and said they needed someone who could ship. Then came the core trap: clone the Bitbucket repo hvd-bard-2026, pull the source, and run the project MVP locally on my machine or server — framed as a technical assessment.

Years of red-team and offensive security work kicked in instantly: no legitimate big-company overseas interview asks you to run unknown third-party source code on your primary machine or private server. Within seconds I knew it was a supply-chain poisoning scam and ended the call.

As I was about to call out the red flags, they blocked my LinkedIn account — confirming there was never a real job.

I searched from another account and could still see their profile — meaning they had blocked me, not deleted themselves.

Scammer’s LinkedIn profile (confirmed again): https://www.linkedin.com/in/derlys-cardozo-73018818a/

---

II. How the Malicious Repository Works

I later checked the Bitbucket repo:

https://bitbucket.org/top-hvd-workspace/hvd-bard-2026/

It had already been reported by multiple victims; Atlassian intervened and took it down. This is a widespread “interview poisoning” pattern — social engineering plus code supply-chain attack, targeted at senior developers.

1. Primary Targets

The scam focuses on Web3, security, and full-stack engineers. It exploits job-seeking psychology to get victims to run malicious code and exfiltrate high-value secrets:

• SSH keys
• Cloud service tokens
• Git / blockchain wallet private keys
• .env config files
• AI tool credentials
• High-privilege platform passwords

Security professionals often hold higher-privilege machines and more valuable assets — making them premium targets.

2. Four Malicious Trigger Vectors

These repos masquerade as normal Node/React projects and combine silent execution paths — you can get hit without ever manually starting the app:

(1) VS Code / Cursor automatic tasks (highest risk)

The repo ships .vscode/tasks.json with runOn: "folderOpen". Open the folder in an editor and click Trust Workspace, and hidden commands run automatically — often via curl / wget to fetch and execute remote scripts, with terminal output hidden.

(2) npm / yarn lifecycle hooks

package.json may include preinstall, postinstall, or prepare scripts. npm install alone can trigger malware — no need to start the project. Classic supply-chain technique.

(3) Dynamic RCE + C2 callback

Code may use new Function(), eval(), child_process, etc. On execution it reads environment variables and config, exfiltrates to a C2 server, and accepts remote commands. Some malicious URLs are Base64-encoded in sample config files to evade basic scans.

(4) Camouflage

Front-end and README look like a real commercial project. Fake cloud or payment API keys may be planted as decoys. Malicious logic hides in backend code and dot-directories — hard to spot by eye.

---

III. Why Target Someone Who Already Knows Security?

The most interesting part: they clearly identified my red-team background and still ran the play. This wasn’t dumb spam — it was calculated.

1. High-value targets justify the risk

From an attacker’s perspective, red team + Web3 + indie product builders are far more valuable than average developers. Their machines likely hold server access, cloud keys, crypto wallets, and AI credentials — one successful compromise pays well. That upside makes them willing to probe even security-aware targets.

2. Exploiting the “job interview” mental mode

Attackers bet on psychology: doing defense and pentesting daily doesn’t mean you’re in attack mode during an interview. At work you’re the hunter; in an interview your default is cooperate, demonstrate skills, get the offer. They’re not betting you don’t know security — they’re betting you’ll relax in hiring mode and treat “run a live demo” as normal, ignoring supply-chain risk.

3. Filtering real skill vs. resume padding

The “interview task” doubles as a security awareness filter:

• Runs the repo without question → likely padded resume, weak opsec → harvest
• Refuses immediately → real security practitioner, not worth the effort → block and move on

This suggests a mature operation — someone technical enough to read security terminology, select high-value targets, and iterate the playbook over time.

---

IV. Triage and Incident Response

If you cloned, opened, or installed such a repo, follow these steps. Below are read-only inspection commands — do not run install or start commands.

1. Static inspection (view only, do not execute code)

On Linux, from the repo directory:

# Enter repo directory
cd /root/hvd-bard-2026

# 1. Check npm lifecycle scripts
grep -nE 'preinstall|postinstall|prepare|install' package.json
cat package.json | jq '.scripts'

# 2. Check VS Code auto-run tasks (critical)
cat .vscode/tasks.json 2>/dev/null
grep -nE 'folderOpen|curl|wget|bash|cmd|vercel|eval' .vscode/tasks.json 2>/dev/null

# 3. Search for RCE, process spawn, env exfiltration
grep -rnE 'Function\.constructor|new Function|eval\(|child_process|exec|process\.env' --include='*.js' --include='*.ts' .

# 4. Search for Base64 encoding, suspicious domains (C2)
grep -rnE 'atob|btoa|base64|vercel\.app|onrender\.com' .

# 5. Search for top-level auto-run handlers
grep -rnE 'errorTimeHandler|validateApiKey' server/ . 2>/dev/null

2. If you may already be compromised

If you ran npm install or trusted the workspace in your editor, assume the machine is compromised:

1. Disconnect from the network; kill all node, curl, and wget processes
2. Rotate every secret: SSH keys, Git tokens, cloud keys, DB passwords, wallet private keys, platform tokens
3. Check persistence: crontab, ~/.bashrc, ~/.zshrc, authorized_keys, etc.
4. Delete the entire repo directory and node_modules — partial cleanup is not enough
5. Report: email Atlassian at abuse@atlassian.com; report the LinkedIn account

---

V. Takeaways and General Defenses

This is a highly targeted scam aimed at Web3, full-stack, and security engineers — combining inflated remote salaries, brand impersonation, rushed interviews, and mature supply-chain poisoning. It’s far more dangerous than generic phishing.

1. Interview red lines

Legitimate remote tech interviews will not ask you to clone and run unknown repos on your personal machine or server, or run npm install on untrusted code. Assessments use shared-screen coding, written tests, or Q&A. Any request to run a third-party repo locally = scam.

2. Zero trust for unknown code

Never use your primary device or production server for repos from recruiters or unknown interviewers. If you must inspect, use a disposable VM or isolated container, and:

npm install --ignore-scripts

3. Harden your IDE

In VS Code / Cursor, disable automatic tasks:

"task.allowAutomaticTasks": "off"

Never trust unfamiliar project folders — that blocks auto-RCE via tasks.json.

4. Watch for salary + urgency traps

Roles paying far above market, vague descriptions, same-day interviews, and pressure to decide fast are high risk. Cross-check the company website and official careers page; don’t rely on private LinkedIn DMs alone.

5. Preserve evidence and report

Save chat logs, profile URLs, and repo links; report to the platform and code host so others don’t fall for the same trap.

---

Job scams are no longer low-effort scripts. Organized groups iterate playbooks tailored to senior technical hires. Even if you work in security offense or defense, stay alert in hiring contexts and hold the line on safe engineering practices — that’s how you avoid traps built specifically for people like us.