LinkedIn job offer hid Contagious Interview malware inside a Git hook

A job offer that arrived as an archive

A developer writing on dev.to has published a first-hand account of a fake recruiting approach on LinkedIn: a 'documentation pack' sent by an apparent recruiter concealed a malicious Git hook, built to run automatically the moment a branch was checked out. The delivery matches what security researchers call the Contagious Interview campaign.

The pitch

According to the account, a recruiter messaged the developer about building the website for a blockchain basketball game whose client was supposedly already in development, covering pages for signing up, deposits and downloads. The supporting materials looked professional: a README with status tags, a suggested reading order, an MVP scope and acceptance criteria. The process insisted on an NDA before anything else was shared. And instead of a GitHub link, the recruiter sent a compressed archive that included a full .git folder.

What the hook does

The author inspected the archive without extracting it, using tar's ability to list files and print individual ones to the screen, operations that execute nothing. Inside .git/hooks sat a post-checkout script, marked executable by all users. Git runs post-checkout on its own after a git checkout or git switch.

The file opened with a tidy comment claiming it only inspected recent commit messages to detect browser extension history updates, complete with grep-based pattern matching. That logic is a decoy, the author explains: when the patterns fail to match, the script sets its match flag anyway, and nothing later in the file reads it. The real work follows. The script detects the operating system, fetches a script built for macOS, Linux or Windows from a Vercel-hosted endpoint, makes it executable and runs it in the background with all output discarded, then exits cleanly so the checkout looks normal.

The author deliberately did not download that second stage, so its behaviour in this specific case is unknown. In published reports on the campaign that the author cites, the follow-up payload exfiltrates credentials and browser data, targets cryptocurrency wallets and installs a backdoor.

Why an archive, and why an NDA branch

Two design choices carry the attack. First, git clone never copies hooks — a cloned repository only receives Git's harmless samples — so a hook cannot reach a victim through a normal GitHub link, but an archive of someone's .git folder can. Second, the hook needed a trigger, and one was arranged: the README told the recipient to handle the NDA first, and the repository contained a branch named NDA. Checking that branch out, from a terminal or with one click in VS Code or GitHub Desktop, would have executed the hook. The victim would never be asked to run anything.

A known campaign

Researchers attribute Contagious Interview to North Korean operators and describe it as targeting developers, particularly in crypto, fintech and web3, through fake recruiters and 'assessments' that execute code when a candidate does something ordinary: installing dependencies, opening a project folder in an editor, or using Git. The author cites a May report from OpenSourceMalware describing the group hiding its loader in Git hooks with the same structure: detect the OS, pull a per-platform script from a Vercel app, suppress output, exit zero.

This sample differs in delivery, the author notes. The reported one was a .githooks/pre-commit file that required a setup step to activate, while this hook arrived pre-installed in .git/hooks, waiting for a checkout. The author stops short of firm attribution: they cannot prove who sent the archive, only that the playbook matches. When they asked the recruiter why a documentation repository needed a hook that downloads and runs a script, no reply came.

Checking files before opening them

The author lists red flags in the order they appear: a web3 or blockchain project with a vague role; files sent before any call, especially an archive rather than a repository link; a .git folder inside what claims to be a documents pack; any step that requires touching the files before speaking to a person; and an account or company that is hard to verify. None is proof on its own, but two or three together warrant slowing down.

The author has also packaged the checks into a free desktop app, LookFirst, for macOS, Windows and Linux. It reads zip, tar and 7z archives in place without extracting or running anything, inspects every branch and tag without invoking Git, and reports in plain language whether anything inside would execute on its own. On the archive described, it flagged the hook immediately. It also recognises two other recent attacks, PolinRider and the Shai-Hulud npm worm, by their files, markers and infected lockfile versions.

Why it matters

This attack needs no software exploit. The trigger is routine developer behaviour — switching branches — and the lure exploits the pressure of a tight job market, where unsolicited recruiter messages get a sympathetic hearing. Standard advice like 'don't run scripts from strangers' fails here, because the victim never knowingly runs anything, and the NDA framing supplies a plausible reason to explore the files. The countermeasure is cheap and concrete: inspect archives before extracting them, and treat a .git folder inside a recruiter's documentation pack as the alarm bell it is.