Iranian Hackers Use Fake Recruiter Coding Test

A suspected Iranian government-backed hacking group approached people while pretending to be recruiters, then used a “coding challenge” as the hook to get targets to run malicious code. Victims were sent a ZIP file containing a trojanized Node.js project that infects the machine when it’s built/compiled, giving the attackers remote access across Windows, macOS, and Linux.

Key findings

• Attackers posed as recruiters and sent targets a ZIP file with a “coding challenge.”
• The ZIP contained a trojaned Node.js project that infected systems when compiled/built.
• The campaign targeted specific individuals via spear-phishing and deployed cross-platform remote access tooling.
• The malware attempted to identify/collect data related to major security products and Google/Microsoft-related directories.

Who’s being targeted

• Commonly targeted roles: Engineering, IT, Security, Recruiting/HR (to recognize impersonation patterns), Executives and high-profile staff (often targeted individuals).
• Affected industries: Software development, Professional services, Government and public sector (targeted individuals).
• Attack channels: email.
• Impersonated: Recruiter / hiring team.

Awareness takeaways

• Treat unexpected “recruiter” files (especially ZIPs) as high-risk; don’t open or run them on work devices.
• Assume building/compiling third-party code can execute commands; only run coding tests in a safe, isolated environment approved by IT/security.
• Be cautious of “skills tests” that require enabling scripts/plugins or running build steps; verify the recruiter and company independently before proceeding.

Red flags to watch for

• Unsolicited recruiter message pushing an attached ZIP/code project
• Instructions require building/running a project from an unknown source
• Pressure to execute build scripts as part of the screening step