[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsH6kILiF0M84By-Pdo79gu-dO89vEW5zB9EupXDE3x8":3},{"article":4,"iocs":57,"watch_terms":58,"solutions":59,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"5a7a1210-6397-4d63-8d15-9581f1e99107","The Take-Home Test That Runs on Your Work Laptop: Inside the AccuraSoftHire Fake Interview Campaign","the-take-home-test-that-runs-on-your-work-laptop-inside-the-accurasofthire-fake-2d9b52","Binance says its $6.34 billion theft began when an engineer ran a fake interview assignment on his work computer. JFrog has now exposed a fake company, AccuraSoftHire, built to run the same trick. We decoded the attacker's server history from a public Ethereum wallet and found npm packages from the interview task that stayed installable for up to seven months. Here is what to check on your developer machines.","JFrog has exposed AccuraSoftHire, a fake company using poisoned npm packages in fake interview assignments to deliver malware. The malicious packages remained on npm for months, with thousands of downloads. The attack vector, similar to one used in a large Binance theft attributed to North Korea, targets developer machines and can compromise credentials.","Fake interview campaign uses poisoned npm packages to deliver malware to developer machines.","https:\u002F\u002Fwww.stepsecurity.io\u002Fblog\u002Faccurasofthire-fake-interview-developer-machines","https:\u002F\u002Fcdn.prod.website-files.com\u002F673b71f0790aabf30bd30bf8\u002F6af73e93eca76a418bb892a9_6af73e72110688dff66f00ec_accurasofthire-cover.png","2026-11-13T17:04:34+00:00","2026-11-13T18:00:35.308868+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"North Korea","threat_actor",{"name":21,"type":22},"AccuraSoftHire","campaign",{"name":24,"type":25},"Binance","vendor",{"name":27,"type":25},"JFrog",{"name":29,"type":30},"npm","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":53},{"id":54,"icon":33,"name":55,"slug":56},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[],[24,27],{"controls":60,"vendors":142},[61,90,117],{"slug":62,"name":63,"problem":64,"products":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":91,"name":92,"problem":93,"products":94},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[95,103,110],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":104,"product_name":107,"url":108,"description":109},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":91,"product_name":114,"url":115,"description":116},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"slug":118,"name":119,"problem":120,"products":121},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[122,130,137],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":131,"vendor_name":27,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"jfrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":131,"vendor_name":27,"vendor_logo":132,"product_slug":138,"product_name":139,"url":140,"description":141},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[143],{"slug":131,"name":27,"logo_path":132,"roles":144},[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":156},"fake-interview-assignments-weaponize-npm-packages-to-compromise-developer-machines","Fake Interview Assignments Weaponize npm Packages to Compromise Developer Machines","AccuraSoftHire, a fictitious company, lured developers into running malicious npm packages disguised as take-home interview assignments — a social engineering technique previously linked to North Korean threat actors in the Binance theft. The packages persisted on npm for months and accumulated thousands of downloads before being removed, demonstrating a critical gap in supply chain vetting and package registry monitoring. Developers trusted the professional framing of a job interview and executed untrusted code on work laptops, exposing corporate credentials and environments. This attack matters because developer machines are high-value targets: they often hold secrets, cloud credentials, and access to source code repositories that can cascade into broader organizational compromise.",[151,152,153,154,155],"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools","CIS Control 16: Application Software Security (v8)","NIS2 Article 21(2)(d)","NIS2 Article 21(2)(g)","NIST SP 800-53 SA-12: Supply Chain Protection",{"NIS2 Article 21(2)(d)":157,"NIS2 Article 21(2)(g)":158,"NIST SP 800-53 SA-12: Supply Chain Protection":159,"CIS Control 16: Application Software Security (v8)":160,"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools":161},"NIS2's supply chain security point requires organisations to assess the security of their software supply chain, which covers evaluating the trustworthiness of externally sourced packages like those used in this campaign.","This point mandates basic cyber hygiene and training, which would include educating developers to identify job-offer social engineering used to deliver malicious code.","SA-12 requires organisations to apply security safeguards to protect against supply chain threats, including the introduction of malicious code through external software components such as these poisoned npm packages.","CIS Control 16 requires vetting third-party software components for security risk before use, which would have prompted scrutiny of the interview npm packages before execution.","The attackers embedded malware inside published npm packages — exactly the dependency-level supply chain compromise this technique describes — to reach developer endpoints."]