JFrog’s Security Research team has uncovered a previously unreported cyberattack operation called “AccuraSoftHire,” which uses fake job interviews to trick software developers into installing malware — the same lure linked to this month’s US$6.34 billion Binance attack.
Key Takeaways
- JFrog’s Security Research team uncovered “AccuraSoftHire,” a fake company built to lure software developers into installing malware through sham job interviews.
- The scheme uses the same fake-interview tactic linked to this month’s US$6.34 billion Binance attack.
- AccuraSoftHire built a convincing front — a careers site, LinkedIn page, client testimonials and ID-verified recruiters — with its domain registered in April and its first job ad in June.
A convincing fake company
According to JFrog‘s researchers, AccuraSoftHire operates as a decoy company complete with a careers website, client testimonials, a LinkedIn page, job advertisements on mainstream job boards and recruiters with ID-verified profiles. Its domain was registered in April, with its first job advertisement appearing in June. Attackers have used fake interviews as a lure since 2023, but the researchers said the Binance attack showed how much damage the tactic can do.
The giveaways, JFrog said, are subtle: recruiter profiles created in consecutive months, and a headquarters address that changes from page to page. Applicants who get far enough are given a rigged take-home test and a video verification step, both designed to deliver malware. Researchers traced the operation back to a single malicious software package, and from there to numerous related packages and a recruiter profile linked through one shared email address.
“After Binance, every attacker running this play can see what it pays, and we expect more of them,” said Guy Korolevski, senior security researcher at JFrog Security Research. “Our research shows these lures are built to pass the checks people rely on: a professional website, a LinkedIn page, job ads on mainstream boards and recruiters with LinkedIn’s verified badge.”
What developers and employers should check
Korolevski said developers with system access cannot be expected to catch these lures alone, so employers need to set clear rules. He recommended that interview assignments involving downloads should only ever be run in a disposable virtual machine, never on a work laptop, and that security teams should warn employees against downloading unknown files even from sources they believe they can trust. Developers can also check when a recruiter’s profile was created and whether a company’s stated location is consistent across its pages.
