IvanGoncharov

I just checked my calendar, and it was a 45-minute interview scheduled on Calendly. HR person sent me a link to Calendly so I could schedule an interview with the CTO. I actually talked with someone pretending to be the CTO for 45 minutes.

I checked other similar threads on HN, but they don't mention an actual Google Meet call with a scammer.

Wow, after reading this article, I figured out I was hacked, but with a way more sophisticated attack.

A few weeks ago, I had an interview with a CTO of a totally legit company. It was weird because he had disabled the camera, and the person had a strong accent. But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about. At the end of the interview, he explained to me that during the technical interview I would need to make some modifications to their project (it's an OSS product), so he asked me to clone the repo and check the setup.

Later, the HR person said the CTO got sick, so the interview would be postponed. But a few days later, the HR profile was deleted from LinkedIn. It was super weird, but it didn't trigger my suspicion until I saw this post on HackNews. I checked, and the repo I was cloning and running during the interview had a malware payload.

P.S. I think it was a targeted attack because in the past I maintained a very popular NPM package with 43+M weekly downloads. That's my only explanation for why someone would carry out such a sophisticated social-engineering attack against me.

P.P.S. It's great that I have 2FA everywhere, and I always publish NPM packages manually without using tokens. But I need to wipe my laptop and reinstall everything.

After you click on "Custom Introspection" card you will see "Copy Introspection Query" link. Just click on it and query will be copied into the buffer.