Avour

.@Toly on why privacy becomes a moat after PMF

I was halfway through a live technical interview when I realized I wasn’t being interviewed, I was being targeted. 🧵 I almost got my entire system wiped and my crypto drained. The recruiters were polished. The project looked legitimate. But 10 minutes in, they made the one request every dev should fear: "Go ahead and clone the repo, so we can walk through the UI together." The Intuition I’ve seen enough supply chain attacks to know that a "test task" is the perfect Trojan Horse. I needed to buy time to audit the code without them knowing I was onto them. So…… I said, leaning back. "Before we dive in, tell me more about the team's approach to scalability. I'd love to hear how the culture has evolved." The Social Engineering, as they spent 5 minutes talking about agile workflows and flat hierarchies, I was secretly flying through their file structure. I nodded along to their stories about Friday happy hours while my cursor was hovering over their backend controllers. Repo (still live): github.com/goldenbusiness… Then, I saw it: userController.ts. The Payload, I kept on with trying to keep the conversation going. While they answered, I decoded the C2 URL: 🔗 jsonkeeper.com/b/UV3OU I pulled the payload. It wasn't just a backdoor; it was a full-scale info-stealer targeting: ⚫️Browser Passwords/Cookies ⚫️Exodus Crypto Wallets ⚫️macOS Keychain access The Turning Point, At this point, I had a choice. Hang up, or call them out. I waited for the "recruiter" to finish their sentence about "career growth," then I cleared my throat. "I have a quick question," I said, my voice dead calm. "How much would you say you guys make from this scam you run” I watched their video feeds. The "technical lead" froze. The "recruiter" started stammering” The panic in their eyes was the best feedback I’ve ever received in an interview. Before they could even come up with a lie, the Zoom window went black. They had terminated the call and deleted their LinkedIn accounts within 30 seconds. What’s the lesson here. These so called Job Interviews lures are getting incredibly sophisticated. They use professional personas and live calls to bypass your better judgment. The 20 lines of code that would have ruined my month were hidden in a sea of 5,000 lines of boilerplate. Audit before you install. Audit before you run. Stay paranoid. Stay safe.

I was halfway through a live technical interview when I realized I wasn’t being interviewed, I was being targeted. 🧵 I almost got my entire system wiped and my crypto drained. The recruiters were polished. The project looked legitimate. But 10 minutes in, they made the one request every dev should fear: "Go ahead and clone the repo, so we can walk through the UI together." The Intuition I’ve seen enough supply chain attacks to know that a "test task" is the perfect Trojan Horse. I needed to buy time to audit the code without them knowing I was onto them. So…… I said, leaning back. "Before we dive in, tell me more about the team's approach to scalability. I'd love to hear how the culture has evolved." The Social Engineering, as they spent 5 minutes talking about agile workflows and flat hierarchies, I was secretly flying through their file structure. I nodded along to their stories about Friday happy hours while my cursor was hovering over their backend controllers. Repo (still live): github.com/goldenbusiness… Then, I saw it: userController.ts. The Payload, I kept on with trying to keep the conversation going. While they answered, I decoded the C2 URL: 🔗 jsonkeeper.com/b/UV3OU I pulled the payload. It wasn't just a backdoor; it was a full-scale info-stealer targeting: ⚫️Browser Passwords/Cookies ⚫️Exodus Crypto Wallets ⚫️macOS Keychain access The Turning Point, At this point, I had a choice. Hang up, or call them out. I waited for the "recruiter" to finish their sentence about "career growth," then I cleared my throat. "I have a quick question," I said, my voice dead calm. "How much would you say you guys make from this scam you run” I watched their video feeds. The "technical lead" froze. The "recruiter" started stammering” The panic in their eyes was the best feedback I’ve ever received in an interview. Before they could even come up with a lie, the Zoom window went black. They had terminated the call and deleted their LinkedIn accounts within 30 seconds. What’s the lesson here. These so called Job Interviews lures are getting incredibly sophisticated. They use professional personas and live calls to bypass your better judgment. The 20 lines of code that would have ruined my month were hidden in a sea of 5,000 lines of boilerplate. Audit before you install. Audit before you run. Stay paranoid. Stay safe.

I was halfway through a live technical interview when I realized I wasn’t being interviewed, I was being targeted. 🧵 I almost got my entire system wiped and my crypto drained. The recruiters were polished. The project looked legitimate. But 10 minutes in, they made the one request every dev should fear: "Go ahead and clone the repo, so we can walk through the UI together." The Intuition I’ve seen enough supply chain attacks to know that a "test task" is the perfect Trojan Horse. I needed to buy time to audit the code without them knowing I was onto them. So…… I said, leaning back. "Before we dive in, tell me more about the team's approach to scalability. I'd love to hear how the culture has evolved." The Social Engineering, as they spent 5 minutes talking about agile workflows and flat hierarchies, I was secretly flying through their file structure. I nodded along to their stories about Friday happy hours while my cursor was hovering over their backend controllers. Repo (still live): github.com/goldenbusiness… Then, I saw it: userController.ts. The Payload, I kept on with trying to keep the conversation going. While they answered, I decoded the C2 URL: 🔗 jsonkeeper.com/b/UV3OU I pulled the payload. It wasn't just a backdoor; it was a full-scale info-stealer targeting: ⚫️Browser Passwords/Cookies ⚫️Exodus Crypto Wallets ⚫️macOS Keychain access The Turning Point, At this point, I had a choice. Hang up, or call them out. I waited for the "recruiter" to finish their sentence about "career growth," then I cleared my throat. "I have a quick question," I said, my voice dead calm. "How much would you say you guys make from this scam you run” I watched their video feeds. The "technical lead" froze. The "recruiter" started stammering” The panic in their eyes was the best feedback I’ve ever received in an interview. Before they could even come up with a lie, the Zoom window went black. They had terminated the call and deleted their LinkedIn accounts within 30 seconds. What’s the lesson here. These so called Job Interviews lures are getting incredibly sophisticated. They use professional personas and live calls to bypass your better judgment. The 20 lines of code that would have ruined my month were hidden in a sea of 5,000 lines of boilerplate. Audit before you install. Audit before you run. Stay paranoid. Stay safe.