Cybercriminals pose as company recruiters and send fake coding tests to trick software developers into installing malware.
Cybersecurity experts have issued an urgent warning after uncovering a dangerous scam where online criminals pose as job recruiters to target software developers with fake coding tests.
Scammers are reaching out to job seekers through professional social networks, promising high-paying remote roles at well-known financial and technology companies.
As part of the interview process, the fake recruiters send candidates compressed files containing what looks like a standard technical assignment.
However, when unsuspecting programmers open the project files and run the test code on their personal computers, a hidden virus silently installs itself in the background, giving online thieves remote access to steal private passwords, cryptocurrency wallets, and confidential company files.
The cybersecurity alert was formally published in online threat intelligence reports on September 1, 2026, after security researchers tracked widespread social engineering campaigns across global developer networks.
Security analysts at Cybersecurity News documented how attackers create realistic archives with names like Python Skill Assessment or Python Skill Test to trick victims.
Because software engineers, freelance programmers, and job candidates expect to take technical tests when applying for software jobs, applicants naturally execute the files without suspecting any digital danger.
The primary reason this sneaky attack works so well is that hackers hide malicious executable code directly inside ordinary looking instruction files and compiled project folders.
When a candidate downloads the assignment, an instruction document inside the folder tells them to run the code immediately to make sure it works properly before fixing any bugs.
To make sure developers do not spend time reading through the code first, the attackers impose strict 15 minute deadlines.
This rush causes stressed job seekers to execute the program quickly, triggering the hidden virus to establish a silent connection to offsite hacking servers.
Explaining how cybercriminals masquerade as legitimate hiring managers to trick unsuspecting programmers into installing computer viruses, cybersecurity analyst Tushar Subhra Dutta reported that “cybercriminals are posing as recruiters and send fake coding tests to infect software developers”.
Detailing how attackers build artificial panic to force applicants into running the infected files without checking for safety, security researchers at ReversingLabs noted that the README files often include tight deadlines, adding that this psychological pressure “compels developers to act quickly and without sufficient scrutiny,” which significantly “increases the likelihood of the malware being executed as developers rush to meet the supposed recruiter’s demands”.
Warning that compromising a single programmer can expose entire corporate networks to massive digital break-ins, threat research teams at Elastic Security Labs emphasized that “this campaign reinforces that developers remain a prime target, where the compromise of a single individual can provide the initial access needed to enable far reaching supply chain attacks against downstream organizations”.
By exposing how fake job recruiters use technical tests to trick job seekers, security analysts are helping developers stay safe online.
Double checking recruiter identities, inspecting code inside safe testing environments, and ignoring rushed interview deadlines ensures that personal computers and sensitive software projects stay fully protected from online thieves.
About the Author
Jennifer Sakmufuwo Baba is a tech analyst, senior staff, and writer covering artificial intelligence, cybersecurity , and emerging technologies at TechRegard. Based in Nigeria, she's passionate about translating complex tech developments into compelling, accessible stories for diverse audiences. Her work focuses on how technology shapes innovation across Africa and globally.
