When Recruitment Turns Into Exploitation – Part 2: The 2026 Scams That Are Targeting Developers Specifically

Scammers have gone professional — and then they went technical.

Part 1 of this series covered the fundamentals: fake recruiters, malware-laced assessment links, deepfake video interviews, and the cruel targeting of people who’ve been job hunting for months. If you haven’t read it, start here.

But this article is about something more specific, and in many ways more dangerous: a new wave of attacks that are engineered for developers, by people who understand how developers think, how technical interviews work, and exactly which moments in a hiring process create the most psychological vulnerability.

If you’re a software engineer, technical lead, or developer currently job hunting — this is the article you need to read before your next recruiter DM.

This article was inspired in part by a detailed firsthand account published by Qwerty on DEV Community, “Don’t get scammed on an interview” (November 2025). Their experience documenting GitHub-based interview scams, malicious repositories, and social engineering tactics provided valuable real-world insight into how these attacks are evolving and how developers can protect themselves. I highly recommend reading the original article for a developer’s perspective on identifying and safely investigating suspicious interview tasks.

How the Attack Works: The Malicious GitHub Interview

Let’s walk through the anatomy of what is, right now in 2026, one of the most sophisticated and underreported scams in tech hiring.

Step 1

A credible-looking recruiter contacts you on LinkedIn. The profile has a headshot, a plausible job history, a few hundred connections. They’re reaching out about a senior or technical lead role — often at a real company in a fast-moving space like Web3, fintech, or AI infrastructure. The job description is well-written. The compensation package is generous. Maybe a little too generous.

Step 2

They schedule an interview. The process feels professional. There’s a calendar link, a meeting confirmation. The first conversation goes smoothly. They move you forward.

Step 3

The technical interview begins. The interviewer — camera off, profile picture that looks slightly too perfect — sends you a link to a GitHub repository. They ask you to:

• Clone the repository locally
• Open it in VS Code specifically (not another IDE — this detail matters)
• Share your screen so they can “walk through the code with you”

Step 4

The moment you run the code, you’re compromised. This isn’t a theoretical attack vector. For example, Trend Micro researchers documented a threat group — tracked as Void Dokkaebi — actively deploying this exact method in 2025 and 2026, using fake job interview lures to distribute malware via code repositories. Full technical write-up: Trend Micro Research, April 2026.

Once executed, the malicious code can harvest SSH keys, browser-stored passwords and session cookies, crypto wallet credentials, environment variables containing API keys or database credentials, and install persistent backdoors for long-term access. If you’re using the same machine for personal and work tasks — which most developers do — the blast radius extends to your employer’s systems as well.

One senior AI engineer who shared their experience publicly described the exact sequence: the Gmail address instead of a company domain, the interviewer’s LinkedIn profile returning a 404 error, the insistence on VS Code and local execution, the defensive hostility when asked to explain the discrepancy between the company’s official GitHub stack and the repo they’d sent. The moment pointed questions were asked, the call ended abruptly. He got out unscathed. Many others haven’t.

This pattern is not isolated. In a widely shared account published by developer Qwerty, the author described being contacted for what appeared to be a legitimate opportunity before being instructed to “share my screen” and “install + run the project during the call” during an initial interview stage. The author later discovered multiple indicators of malicious intent and documented the experience as a warning to other developers.

Why Developers Are Being Specifically Targeted

This isn’t random. Scammers have studied how technical hiring works, and they’ve identified the precise leverage point: a developer’s willingness to demonstrate competence.

The genius of this attack, from the attacker’s perspective, is that it exploits professionalism rather than naivety. Running code as part of a technical interview isn’t suspicious — it’s expected. Sharing your screen with an interviewer is normal. Cloning a repository is something developers do dozens of times a week. Each individual action is routine. The combination, in this specific context, is the trap.

And the psychological conditions in 2026’s job market make this more exploitable than ever. The average job search duration for senior tech roles in 2025–2026 is approximately 6.6 to 9.7 months (Career Agents — How Long Does It Take to Get a Job in 2026?).

After months of applications, automated rejections, and silence from companies, a credible-looking opportunity feels like oxygen. You don’t want to be difficult. You want to prove you’re the right person. You’re willing to do the task, run the code, share the screen. That psychological state — hopeful, eager, slightly off-balance — is precisely what these attacks are engineered to exploit.

The cruel irony is that the more technically skilled you are, the more you may be inclined to comply. Running unfamiliar code in a sandboxed mental model is something experienced developers do all the time. The assumption that “I’ll just run it and see what happens” is built into the way many engineers approach the world. Attackers know this.

One of the most insightful observations from Qwerty’s experience is that these scams don’t rely on technical ignorance. They rely on professional habits. As the author notes, the interview process felt legitimate until the moment the candidate was expected to execute code on their own machine. Because cloning repositories, reviewing code, and sharing screens are normal parts of technical work, attackers are exploiting behaviours developers have been trained to view as routine.

The Broader Landscape: What’s Evolved

The GitHub malware scam is one tactic within a broader, rapidly professionalising ecosystem of hiring fraud. The other methods documented in Part 1 have continued to evolve:

Deepfake video interviews are now genuinely indistinguishable in many cases. Real-time face-swapping tools have become more accessible and more convincing. Pindrop reported a 1,300% increase in deepfake fraud attempts targeting hiring and identity verification contexts in 2024–2025, with projections of continued growth into 2026 (Pindrop — Deepfake Fraud Could Surge).

Identity theft using real professionals’ profiles has become more sophisticated. Scammers are harvesting public LinkedIn data, GitHub profiles, conference speaker bios, and even academic publications to construct personas with apparent depth and credibility. Some have begun impersonating professionals who have recently left a company — a window during which the person’s old associations still register as plausible.

“Pay to proceed” schemes now appear much later in the funnel, sometimes after three or four rounds of interviews. The psychological investment makes the ask feel more legitimate by the time it arrives — and the sums requested have grown. The FBI’s Internet Crime Complaint Center (IC3) recorded over $21 billion in total losses from internet crime in 2025, with employment and job fraud being a significant and growing category (FBI — Annual Internet Crime Report).

The Red Flags: A Field Guide for Technical Interviews

These aren’t abstract warnings. These are the specific signals, reported by real people in real incidents, that something is wrong:

About the recruiter and their profile

• LinkedIn profile created less than three months ago
• Fewer than 100 connections, with no obvious pattern of professional relationships
• Profile picture that looks AI-generated (too smooth, too symmetrical, eyes slightly off)
• Their name doesn’t appear on the company’s official team page, website, or any press coverage
• Google search of their name and company returns nothing — or the LinkedIn link itself returns a 404

About the communication

• Interview invitations sent from a personal Gmail or Yahoo address rather than a company domain
• Calendar invites from personal accounts
• Pressure to move quickly, often with urgency framing (“we need to fill this before end of month”)

About the technical process

• Asking you to clone and run code locally during a first-round interview
• Specifically insisting on VS Code (legitimate interviews use platform-agnostic tools)
• The GitHub repository belongs to a random or new account, not the company’s verified organisation
• The tech stack in the repo doesn’t match the company’s documented, public work
• Screen sharing requested before any formal offer or NDA is in place
• Evasiveness or hostility when you ask technical questions about the discrepancy

The rule that legitimate companies follow: Real technical assessments in 2026 use shared IDEs, browser-based coding platforms, or sandboxed environments — CoderPad, GitHub Codespaces, HackerRank, LeetCode-style interfaces. They do not require local execution on your personal machine. If someone insists on this, it’s either incompetence or malice. Neither is a reason to comply.

What to Do If You Suspect You’ve Been Targeted

Before you run anything: Pause. Ask to verify. Check the company’s official career page and see if the role exists. Email the company’s HR team directly using the address on their official website — not a number or address provided by the “recruiter.” Ask the interviewer to connect via the company’s official communication channels.

If you’ve already run the code: Act immediately. Disconnect the machine from the network. Change passwords for every critical account from a different, clean device — starting with email, then banking, then work systems. Rotate SSH keys. Check for newly installed processes, services, or startup items. Alert your employer’s IT or security team if there’s any possibility work systems were accessible on the compromised machine. File a report with the FBI’s IC3 (ic3.gov) in the US, or your country’s equivalent cybercrime authority.

To protect yourself structurally: Consider keeping a separate, isolated machine or VM for any interview-related code tasks. Use a dedicated browser profile for job hunting that doesn’t store work credentials. And when in doubt, end the call and apply through the company’s official careers page directly. If the opportunity was real, it’ll still be there. If it vanishes the moment you ask a reasonable question, you have your answer.

The Systemic Problem Underneath the Individual Attacks

These scams are a symptom of a hiring ecosystem that, by design, creates information asymmetry and pressure. Job seekers are expected to prove themselves repeatedly, quickly, and often under conditions set entirely by the hiring side. They rarely have independent ways to verify who they’re speaking to.

The shift toward more dynamic, verifiable hiring processes — where both candidates and companies can establish authenticity before committing to a conversation — is one of the most important structural changes the industry needs. Static documents and anonymous contact forms weren’t built for a world where a fake recruiter can build a convincing LinkedIn presence in 48 hours and weaponise a GitHub repo. We are building this at vairee.

Until verification becomes structurally embedded in how hiring works, the responsibility falls on individuals to build their own defences. This guide is one part of that.

A Final Note on Who Gets Targeted

Scammers don’t target the most naive people. They target the most hopeful ones.

If you’ve been searching for months, if you’re under financial pressure, if you’ve finally started to believe that this opportunity might be the one — that’s the moment your guard is most likely to drop. That’s the moment to apply it most deliberately.

Your skills are real. The right opportunity will not ask you to compromise your machine to prove it.

If you’re currently navigating a job market that increasingly feels like a minefield, Recberry’s job seeker resources include practical guides on spotting hiring fraud, vetting opportunities, and approaching your search with a framework — not just hope.

Stay sharp. Share this with anyone you know who’s currently looking. It might be the most useful thing they read this week.

Have you encountered a suspicious GitHub-based “interview task,” a deepfake interviewer, or a pay-to-proceed scheme in 2026? Share your experience in the comments. Your account could protect someone else’s livelihood.

References

Referenced in this article (verified September 2026).

• Qwerty. “Don’t get scammed on an interview.” DEV Community, 26 November 2025
• Trend Micro — Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories
• Career Agents — How Long Does It Take to Get a Job in 2026?
• Pindrop — Deepfake Fraud Could Surge
• FBI — Annual Internet Crime Report
• FBI Internet Crime Complaint Center (IC3)

#JobSearchSafety #RecruitmentScams #DeveloperSecurity #CyberSecurity #TechHiring #DeepfakeScams