Vector
There is a type of fraud, perpetrated against job seekers, termed a "Contagious Interview." The tactic has been around for a few years now, and like many fraud tactics, has been evolving and spreading. Originally, it was targeted at developers: a fraudster would ask a job seeker to clone and execute code from code hosting platforms, like GitHub. The code package would have a malicious payload attached to it, and if it was run in an insecure environment, that payload would be installed on the target's computer/network.
It's taken a while, but the technique is now being deployed against other job seekers. Some examples I've heard of are people being asked to record videos of themselves for verification purposes or even something as simple as being sent a Zoom link. In each case, the target is presented with an error message or dialog box that informs them that a driver, or their Zoom installation, is out-of-date and that specific commands need to be run in the Terminal to address this and continue.
Of course, updating camera drivers or video conferencing software doesn't require Terminal commands; this fraud depends on targets following instructions, even when they don't understand precisely what they are doing. And that relies, at least in part, on a certain amount of anxiety. And there's no shortage of anxiety among job seekers today. Someone flustered by a potential roadblock between them and an interview is much more likely to follow dodgy instructions than someone feeling more secure in their situation.
And, of course, someone stressed from being unemployed will find being stolen from via malicious software running on their computer to be a bigger blow than someone with a steady income. But money is money, and the fact that a dollar, pound or euro goes a fairly long way in a poor or developing nation means that people there will continue to target people in wealthy nations who are looking for work. It's a form of resource curse unto itself, and one that will keep evolving, so long as the world's poor have easy access to websites and people's inboxes.
No comments:
Post a Comment