Job interviews have become a growing attack vector as threat actors deploy deepfakes and malicious code disguised as test assignments to target both candidates and recruiters in the IT sector.
Attackers first gain trust by posing as company representatives, then ask applicants to review or fix code in repositories on GitHub, GitLab, or Bitbucket. Infection occurs through compromised npm packages or Visual Studio Code extensions that install backdoors capable of capturing cryptographic keys, passwords, screenshots, and clipboard contents.
Historically, state-linked groups such as Lazarus sent fake job offers to chemical and IT companies that delivered trojans. A specialized collective named Contagious Interview now focuses exclusively on this tactic.
One documented case involved a Python developer from the Smello project who received an offer from a crypto startup. The test task required cloning a repository and running npm install; analysis revealed a prepare script that would have loaded a backdoor connecting to an attacker-controlled server.
Recruiters also face risks when sophisticated deepfakes allow unqualified or malicious individuals to impersonate candidates during video calls. Gartner forecasts that by 2028 every fourth interviewee could be fake, raising concerns beyond poor hiring decisions to include industrial espionage and data breaches.
Security researcher David Mochadlo described two convincing deepfake interviews within a single month; visual artifacts and an unexpected accent ultimately revealed the deception. Companies such as Socure flag indicators including newly created email addresses and unverifiable education claims.
Defensive measures for candidates include running all test code exclusively inside virtual machines and manually inspecting repository contents before execution. Organizations are advised to verify candidate profiles, train staff to spot desynchronization between audio and video, and apply interview protocols such as the GOTCHA movement challenges developed at New York University, which detect deepfakes in nearly 89 percent of cases.
Additional academic methods include eye-gaze pattern analysis from Clarkson University and corneal reflection of geometric probe patterns tested at the University at Buffalo. Microsoft and other vendors recommend these layered approaches because deepfake technology continues to advance rapidly, as noted by Unit 42.
In response, firms including Cisco, McKinsey, and Google have reintroduced in-person interviews to reduce reliance on remote verification that deepfakes can compromise.
