Fake Recruiter Checklist: Candidates and Employers
Binance said an engineer was reached through a legitimate job platform, interviewed twice, then told to download an “assignment” to his work computer. It ran malicious code during setup. Use this checklist before you accept a recruiter's assignment, or to test whether your organisation would stop the same lure. Read the full guide to fake job interview malware or rehearse the decisions in the Fake Recruiter Interview Lab.
- I will not download or run an interviewer's code on a work computer, or on any machine that holds work access, wallets or keys.
- I read before I run: I look at the repository as plain text first, including setup and install steps, package manifests and editor task files, and I do not accept an editor's "trust this folder" prompt for code I have not read.
- I know what I would do if I ran something: disconnect the machine, tell my security team straight away, and change passwords and rotate keys from a different, clean device.
Tick an item when it is true for you or your organisation. Ticks stay in this browser only; nothing is sent to us.
1. First contact
A message on a job platform or social site, a friendly profile, a role that sounds right.
2. Interview
A video call with a "recruiter", a chat-app interview with a "CEO", a request to install something to join.
3. The assignment
A take-home test, a repository to download, a setup step that "just needs to run".
- High impact
- High impact
4. Tooling and access
Developer tools, internal AI tools, tokens on workstations: what a foothold can reach.
5. If it already ran
Stop, isolate, report, rotate. Stage-level steps only.
- High impact
TL;DRWhat this checklist is
5 points
- Two checklists in one page: one for candidates who get a recruiter message, one for employers, HR, engineering and security teams.
- Grouped by stage: first contact, interview, assignment, tooling and access, and what to do if it already ran. A risk summary updates as you tick.
- Built from public reporting on North Korea-linked fake job interviews (Unit 42, Google GTIG, Microsoft, Securonix, Trend Micro, GitHub) and from Binance's own account of its 29 October 2026 incident, worded "Binance said" because it has not been independently verified.
- Free to use. Your ticks stay in this browser and nothing is sent to us. Markdown and PDF exports are available with a paid plan.
- Defensive and educational only: stage-level steps, no payloads, no commands.
Frequently asked questions
What is a fake recruiter attack?
A person posing as a recruiter or hiring manager contacts a developer, runs an interview process, and asks the candidate to download and run an assignment or install a tool. The aim is to run malicious code on the candidate's computer. Binance said this is how a software engineer was reached in September 2026, through a legitimate job platform, with a video interview, a chat-app interview and an "assignment" repository that executed malicious code during setup.
Is this the same as the North Korean IT worker scheme?
No. In the IT worker scheme the North Korean worker pretends to be a job applicant and gets hired by the employer (FBI alert I-101326-PSA, 13 October 2026). In the fake recruiter scheme the attacker pretends to be the employer and targets the candidate. Some vendors group both under the name FAMOUS CHOLLIMA, so check which line of activity a report describes.
Which items matter most?
The ones marked High impact. For candidates: never run an interviewer's code on a work computer, read it before you run it, use a disposable environment, and know what to do if you ran it. For employers: no outside code on company devices, deployment tokens off workstations, least-privilege internal AI tools, and a runbook for "an engineer ran something".
Does it store my answers?
Only in your own browser (local storage), so you can come back to it. Nothing is sent to PlayCISO servers. Clearing site data removes it.
Can I download the checklist?
Yes. Markdown and PDF downloads are documents, so they need a paid plan. Using the checklist on the page is free.
Is it accurate for my country and platform?
The controls are general. The sources are US and global vendor reports and, for the Binance items, Binance's own account. Reporting routes differ by country: the checklist names ic3.gov for the US; use your national cybercrime reporting service elsewhere.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.