September 23, 2026

A "take-home test" at a job interview took the keys. The victim wasn't a crypto project

PUBLISHED: Sep 23, 2026

On September 22, SlowMist and SentinelOne detailed a fresh campaign by the North Korean group TraderTraitor — the same actor that took $292M from KelpDAO in April through the LayerZero breach. The new victim had nothing to do with crypto: an Indian IT services firm, one infected MacBook belonging to a DevOps engineer. That was enough to open the company's entire cloud.

How it works:

• A "recruiter" from a company that doesn't exist messages the engineer — targets are picked from GitHub profiles: DevOps, infrastructure, crypto and fintech
• The take-home test is a repo link (terraform-candidate-repo, Northwind-IAC)
• Inside sits an ordinary-looking .terraform.lock.hcl pointing at the attacker's "provider registry": registry.hashicorp-aws[.]com instead of the real registry.terraform.io — a few characters apart
• The candidate runs terraform init. Terraform treats the lock file as the source of truth, then downloads and executes the attacker's module
• Rust backdoors for Apple Silicon land on the machine: FLATROOF (posing as SystemUpdate) and ROOFDECK (iSync, later loginwindow). The macOS quarantine flag is stripped immediately, so Gatekeeper stays silent

What they take: AWS and GCP tokens, SSH keys, source-control access, browser passwords, terminal history, login.keychain-db and the clipboard — where addresses and seed phrases pass through. Commands arrive over the Nostr relay network, so a plain domain blocklist never sees it.

This continues the scenario that Japan's NPA, the FBI, and Australian and German agencies warned about on September 18: 30,000 infected devices in 100+ countries, 7,000 wallets, $10.7M. The difference is the prize — no longer the wallet on the laptop, but the keys to the cloud and the repos.

What to do:

• Run take-home tests in a VM or container only. Never on the laptop that holds your wallets, SSH keys and cloud access
• If a .terraform.lock.hcl is in the repo, open it and check the registry: registry.terraform.io and nothing else
• VS Code asking "Do you trust the authors of the files in this folder?" — No. Restricted Mode stops .vscode/tasks.json from auto-running
• Red-flag strings in any "assignment": curl, base64, -enc, mshta, iwr, hidden
• An interviewer whose camera dies "because of the network" is part of the same script: the face is AI-swapped
• If infection is possible: disconnect the machine, treat every key and seed phrase on it as stolen, rotate cloud tokens, create a new wallet on a different device, reinstall macOS clean

Got paid from an address you don't know? Screen the sender before that money moves to an exchange: https://t.me/amlconsensus_bot?start=en First check is free.

Sources: SlowMist TI Alert, Sep 22, 2026; SentinelOne Labs "TraderTraitor Backdoors Resurface"; joint advisory NPA/FBI/ASD/BND, Sep 18, 2026.