Imagine someone on your technical team gets a message on a job platform. It is a well-paid offer from an AI or crypto company, with a video interview and a second round with the director. At the end they ask for one more thing: download a coding test and run it on their computer. They do it on their work laptop, because it is the one they have at hand.

◢How does a fake job interview with malware work?

It is a social engineering scam that uses the job offer as bait. Binance's report describes each step. First, a video call with a supposed HR representative, who shared a social media account with personal photos and videos to build trust. Then a second interview, on a popular chat app, with someone claiming to be the CEO. Near the end, the engineer was told to download an "assignment" containing a malicious code repository onto their work computer.

Running it installed malware that, according to Binance, the endpoint protection tools did not detect at the time. Nobody opened a strange attachment or clicked a suspicious link: the victim ran code believing it was part of the hiring process.

◢Who is behind it and how widespread is it?

◢What are the warning signs of a fake offer?

• ▹You are asked to run code or install an application on a company device, or one connected to its network.
• ▹The "technical test" means running packages, scripts or repositories you do not know.
• ▹They insist on unusual software for a simple task, or ask you to run a script to "fix" your camera or video call.
• ▹They want to move the conversation to another messaging app.
• ▹An unexpected offer arrives with a very high salary and no negotiation.

The 2026 joint advisory adds one more detail: in some interviews the attackers used AI face-swapping software and, after a few minutes, turned off their video and asked the victim to do the same, blaming the network. If the picture suddenly goes dark in an interview and you are asked to run something, stop.

◢What should you do if you are asked to take a coding test?

A legitimate coding test does not need your work computer. The authorities agree on the basics:

• ▹Do not run tests or third-party code on a company device. If it has to be run, use a virtual machine on an isolated personal device, or on one lent by the person giving the test.
• ▹Be wary of commands containing "curl", "base64" or "-enc" if you do not understand what they do.
• ▹If you open an unknown project in Visual Studio Code, answer "No" when it asks whether you trust the author. It then opens in restricted mode and does not run the project's task file, a trick documented in the joint advisory.
• ▹Verify the person through another channel, for example a video call on a different app and the company's official website, not the links they sent you.

◢What can the company do?

The Binance attack did not end with one laptop. According to its report, on 20 October the attackers used the engineer's computer and an internal AI tool to take control of two other engineers, and on 29 October they used the stolen credentials to reach the service that signs transactions. One compromised machine opened the way to the important systems.

For an ordinary company, this comes down to a few decisions:

1. ▹A written rule: nobody runs outside code on a work device, and hiring tests are done on isolated personal devices.
2. ▹Development machines with minimal permissions and no production credentials stored on the laptop. It is the same idea I describe in AI agents with too many permissions.
3. ▹Internal AI tools with limited access: if an attacker gets into one machine, they should not be able to use the tool to reach others.
4. ▹An easy way to raise the alarm. Whoever ran something dubious must be able to say so without fear of a telling-off.

If someone has already run something, the FBI recommends disconnecting the device from the internet but leaving it powered on to preserve the malware's traces, and reporting it. The joint advisory adds that even if antivirus removes it, you should assume the data has already left: change passwords from another device and reinstall the system.

◢And if you are the one hiring

The technique also works in reverse: the joint advisory³ also covers North Korean IT workers who get jobs at companies abroad, helped by people who run computers for them remotely. Verify candidates' identity during hiring and be wary of anyone who never turns the camera on.

◢How I cover it in training

This kind of attack mainly targets technical profiles, but the rule of never running outside code on a work device has to be known by the whole workforce. In my cybersecurity training I work through real cases like this one, so the rule is clear before the offer arrives.