Fake job scam operating under name of AccuraSoftHire exposed by JFrog

Software supply chain and DevOps company JFrog has recently exposed an anonymous cyber attack operation operating under the name 'AccuraSoftHire'. According to a report by BusinessLine, this is a scam where software developers seeking new jobs are targeted with fake hiring offers.

JFrog's research team stated that AccuraSoftHire is a fake company. To make the scam appear legitimate, cybercriminals have set up a professional career site, client testimonials, a LinkedIn page, and posted job advertisements on major job boards. Furthermore, ID-verified recruiters via LinkedIn were used in this process to ensure candidates trust the offer.

In this process, applicants either contact the alleged recruiters through their advertisements or are targeted by the cybercriminals themselves. During the hiring process, candidates are given a 'take-home test'. Under the pretext of this test, they are asked to install content through which the criminals can send malware into their systems.

Guy Korolevski, Senior Security Researcher at JFrog Security Research, stated, "After the Binance attack, every attacker adopting this method can see how much profit can be made, and we expect such cases to increase." He added that these types of scams have given rise to incidents like the attack on Binance, where assets worth 6.34 billion dollars were affected.

According to Korolevski, the lure is designed in such a way that it appears genuine under normal scrutiny. Due to the professional website, LinkedIn page, and recruiters with verified badges, it becomes difficult for developers and employees with system access to identify it. Therefore, he emphasised that employers should establish strict rules for this.

As security measures, Korolevski suggested that if anything needs to be downloaded in interview assignments, it should never be run on office laptops, but only on disposable virtual machines. Furthermore, security teams should warn employees not to download unknown files, even if the source appears trustworthy.

He provided some tips for developers, including checking when the recruiter's profile was created and ensuring that the company's location is consistent across every page. He noted that this type of fraud occurred even before the AI era, but has now become more sophisticated and increased in number due to AI. Due to AI-generated fake images and websites, it has become more difficult to know if a company is fake.

In its detailed report, JFrog has advised developers to treat take-home tests as 'untrusted code' and open such unknown projects only in VS Code's restricted mode. Korolevski clarified, "In a legitimate interview, you never need to install a driver, and we do not know of any company that sends 'recommended VS Code configuration' via a curl command."