AI
Job Offer Scam Mechanics and Target Selection
Attackers impersonate recruiters on LinkedIn, Upwork, Fiverr, and job forums to send developers malware-laced coding assessments. The offer Baltariu received promised remote work at $85 per hour, paid in cryptocurrency. The message named no company, asked for React skills that weren’t on his resume, and requested his GitHub before delivering a Bitbucket repository named “uddex” under an account called “vte3mox.” The repo was the assessment. Running it was the infection.
Malicious Repository Red Flags
Every poisoned repository Baltariu analyzed followed the same pattern. Usernames and project names are vague or random, like “vte3mox” and “uddex.” All files share a single commit date, impossible for any real multi-developer project. Where the git history isn’t stripped entirely, one late commit stands apart from the rest by over a year, authored under a stolen or disposable email. The one Baltariu traced belonged to Washington University. To bury the payload further, attackers spread changes across many files, forcing anyone auditing the diff to open dozens of them before finding the injected code, which landed in next.config.js.
JavaScript Loader Obfuscation Techniques
The loader hides in next.config.js behind whitespace. He showed the hidden JS code revealed by horizontal scrollbar (10:16) live.
“that would be I think around 700 spaces or something before the malicious code is actually seen” — Ionuț-Alexandru Baltariu
Newer variants skip static placement. They fetch code from a public API like api.endpoint.io and run eval, or hide the call inside an error handler that always fires because the attacker’s URL returns a 500. Newer samples layer base64 over ASCII. Deobfuscated, every variant reveals browser extension IDs, credential paths, and an OS-aware command that drops the next Python stage.
Python Payload Chain: BeaverTail and InvisibleFerret
The JS loader starts a Python loader that fetches more scripts, each obfuscated through up to 50 base64 layers. pay.py (17:22) grabs the victim’s IP, logs keystrokes and clipboard, downloads AnyDesk from an attacker domain, and reports to the C2 over a socket. A browser stealer decrypts passwords and credit card numbers from Chromium databases, then loads Tsunami, a .NET backdoor routing C2 through Tor. The injector finds the executable by iterating 10,000 XOR-encrypted Pastebin URLs (22:07). Tsunami mines Monero and Ethereum, throttles dynamically, suspends when Task Manager opens, and runs a configurable stealer targeting wallets, seed phrases, and files.
“Just imagine how damaging uh malware like this could be” — Ionuț-Alexandru Baltariu
Lazarus Attribution and Evolving Delivery Methods
Bitdefender attributes BeaverTail and InvisibleFerret to the Lazarus group (APT38). The cryptomining behavior and C2 infrastructure match North Korean modus operandi: sanction evasion through stolen compute. The campaign, known as Contagious Interview or Deceptive Development, has run since December 2022 and keeps mutating. In the last year, Lazarus moved from poisoned repos to malicious npm packages, where every line of the project looks clean until npm install pulls the infected dependency. They also began shipping malicious VS Code extensions, framed as required project tooling.
The social engineering escalated too.
“they have started to host interviews” — Ionuț-Alexandru Baltariu
Calendar invites, live meetings, deepfake interviewers, real-time pressure to run the repo on your primary machine. And now generative AI accelerates the malware side.
“spreading the information about these job offer scams um might save potential victims from future hacks” — Ionuț-Alexandru Baltariu
Q&A
Can Bitdefender detect or give heads-up about sketchy code in these attacks? Any security solution would likely detect these scenarios, but the speaker argued that skepticism and manual double-checking alone can prevent infection without needing one. ▶ 33:47
Would an endpoint solution catch the malicious file downloads and process creation? Detection depends on the solution and how current the malware is — many solutions flag these samples on VirusTotal now, but the attackers change code to evade signatures, making it a continuous arms race. ▶ 34:37
How often do BeaverTail and InvisibleFerret appear in other North Korean operations like the DPRK fake IT worker scheme? The speaker said BeaverTail and InvisibleFerret are almost exclusively tied to the Contagious Interview campaign, with roughly 99% of incidents linked to it. ▶ 36:11
Why attribute this to APT38 specifically rather than Stardust Chollima, given the Tsunami loader is not always deployed? Bitdefender’s attribution rests on shared tooling and infrastructure with known North Korean operations, though the speaker acknowledged different vendors carve the Lazarus cluster into different subgroups and there is no consensus on the exact team boundary. ▶ 38:29
Notable Quotes
that would be I think around 700 spaces or something before the malicious code is actually seen Ionuț-Alexandru Baltariu · ▶ 10:29
Just imagine how damaging uh malware like this could be Ionuț-Alexandru Baltariu · ▶ 18:19
spreading the information about these job offer scams um might save potential victims from future hacks Ionuț-Alexandru Baltariu · ▶ 32:16
it’s always a fight between the two sides Ionuț-Alexandru Baltariu · ▶ 35:44
they have started to host interviews Ionuț-Alexandru Baltariu · ▶ 29:36
Key Takeaways
- Never run a recruiter’s repository on your primary machine — always use an isolated VM or container.
- Inspect horizontal scroll and diff views before running any unfamiliar JavaScript project.
- Lazarus actively mutates payloads and delivery vectors; static signatures alone will not keep you safe.
About the Speaker
Ionuț-Alexandru Baltariu
Ionuț Baltariu is a Technical Lead and blog author in the Core Threat Protection & Intelligence team at Bitdefender. His aim is to limit the impact of threats that spread through social media, so he is hunting daily for account takeovers, malware and “malvertising” on platforms. While not hunting, Ionuț takes part in the development of internal automation systems and on various risk assessment products.