Fake Recruiter Interview Lab: Spot the Trap
A friendly message on a job platform. A video call with “HR”. A chat with the “CEO”. Then a repository to download. Binance said that is how an engineer was reached before its 29 October 2026 incident. Live the process, make the calls and see where a lure would have found you. Prefer to read first? Start with the guide to fake job interview malware, or use the fake recruiter checklist.
You are Sam Rivera, a backend engineer at Quillstack Software with access to production deployments. A recruiter message arrives. Across 10 to 12 decisions you live a simulated fake-recruiter process modelled on what Binance said about its October 2026 incident and on public vendor reporting. Everything here is fictional: the people, the company, the repository and the hosts. No code or command appears; the repository is described in words. Each call is scored 0 to 10 with the source behind the rationale.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this lab is
5 points
- A scenario lab: a fictional fake recruiter contacts you on a job platform, runs an HR video round and a CEO chat round, then asks you to download an "assignment".
- You make 10 to 12 scored decisions: verifying the person, where to run unknown code, install prompts, developer tooling, workstation tokens, internal AI tools and the response if it ran. Each is scored 0 to 10 with the source behind the rationale.
- Modelled on what Binance said about its 29 October 2026 incident and on public reporting from Unit 42, Google GTIG, Microsoft, Securonix, Trend Micro and GitHub. Binance's account is worded "Binance said" because it has not been independently verified.
- Free to play. A final score and grade, a shareable scorecard and next-step links. A downloadable debrief is available with a paid plan.
- Defensive and educational only. No code, commands or real attacker infrastructure appear; the repository is described in words and every host is fictional.
Frequently asked questions
Is this based on a real attack?
It is modelled on Binance's own account of its 29 October 2026 incident and on public vendor reports. Binance said a software engineer was contacted through a legitimate job platform by someone posing as a Project Director, had a video interview with a purported HR representative, a second round in a chat app with someone claiming to be the CEO of a fictitious company, and was told to download an "assignment" that executed malicious code during setup. The people, company, repository and hosts in the lab are fictional.
Does the lab contain malware or attack instructions?
No. It contains no code, commands, payloads or real infrastructure. The repository is described in words, and every address uses a reserved example domain. It teaches you what to notice and how to respond.
Who is behind these fake recruiter attacks?
Binance said the FBI indicates North Korea is responsible for its incident. Vendors track fake-recruiter campaigns under several names, including Contagious Interview (Palo Alto Unit 42, MITRE), UNC5342 (Google), Famous Chollima and Void Dokkaebi (CrowdStrike, Trend Micro) and Slow Pisces or TraderTraitor (Unit 42). The guide maps the names and says which one refers to what.
How is it scored?
Each decision scores 0 to 10 and the final score is the share of the maximum along the path you took. The scenario branches: running the assignment on a work computer or installing a fake "fix" sends you into the response steps instead.
Can I download my debrief?
The debrief is shown on the page for free. Downloading it as Word, PDF or Markdown needs a paid plan.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.