AI-Powered Drainer Scams Target IT Job Seekers via Malicious Repositories and Fake Recruiters
The IT job market has turned increasingly turbulent due to economic instability, mass layoffs, reduced vacancies, and widespread AI adoption that threatens to replace developers. This uncertainty pushes specialists to test their market value or seek new roles after cuts, with searches sometimes lasting months or years.
These pressures make candidates more willing to accept questionable requirements, lower salaries, or endless hiring stages. As a result, scam vacancies have proliferated. Attackers exploit fears and anxieties, and current conditions create ideal conditions for such schemes.
Drainer scam originally referred to theft of private keys from crypto wallets, allowing attackers to drain all valuable assets including cryptocurrency, tokens, and NFTs. The technique has migrated to recruitment: fake recruiters contact candidates and propose applying for a role. Variations include asking candidates to complete test tasks by cloning projects from private repositories, join corporate applications that require installing malicious browser extensions, or share screens during calls while being instructed to download and run code.
Particularly motivated scammers conduct real video calls, ask relevant technical questions, and maintain the appearance of legitimate interviews. Rumors suggest involvement of operatives from a closed Asian country with a leader whose name begins with “Kim,” sometimes using AI deepfakes to alter appearance while retaining noticeable accents.
First signs of deception often appear when an HR message arrives unsolicited on a job site. Modern markets have reversed the dynamic: candidates now apply en masse while recruiters receive hundreds of responses. Superficial questions without follow-ups or immediate confirmation that a candidate fits the salary range should raise alarms, as genuine recruiters probe technical fit, team compatibility, and motivation.
Verification steps include checking LinkedIn profile history and real professional connections, confirming the company website and corporate email, and ensuring consistency between the vacancy, communication, and technical task. Multiple red flags together warrant caution.
Before running any repository, inspect package.json, lock files, .npmrc, install scripts, and CI/CD configurations on GitHub. Look for suspicious dependencies, obfuscated code, secret references, or unexpected network calls. Use AI assistants such as Copilot or Claude for static analysis without installing dependencies.
If execution is unavoidable, run the code in an isolated environment without personal keys, passwords, or sensitive files. After any suspected compromise, audit the system, rotate credentials from a clean device, revoke tokens, and review account activity.
The author personally lost approximately 2000 USD in cryptocurrency after completing a test task involving crypto payment integration. The assignment arrived via Google Docs rather than a repository branch, and communication occurred through a translator. Similar scams have since multiplied, prompting the author to engage with them deliberately in controlled environments to study evolving tactics.
Related articles
Marketplace Scraping in 2026: Why Timer-Based IP Rotation Undermines Parsers
Analysis of one full day of telemetry from MobileProxy.Space reveals how marketplace anti-fraud systems detect scrapers through session continuity and rotation patterns rather than IP reputation alone. Over 2 million IP changes were recorded across 8,878 modems, with a median of 95 unique addresses per modem. Timer-driven rotations accounted for 60.2% of all changes, and 92.2% of those intervals were exact multiples of one minute, with a median of 120 seconds. Such rigid periodicity stands out against natural mobile network behavior where address changes occur irregularly due to cell handovers or PDP context resets. The data also shows that 73.1% of address changes complete within five seconds, yet duplicate rotation commands still occur in 0.8% of link-triggered events. The recommended approach ties rotation to parser session state, recreates cookies and TLS profiles on each change, and waits for address confirmation before resuming requests.
Bank Transfer Comments Such as 'Bribe' or 'To the Common Pot' Risk Triggering Compliance Reviews
Lawyer Meri Valishvili warned that casual or joking comments added to bank transfers can prompt automated compliance checks and account restrictions. Systems scan payment descriptions for terms like 'bribe', 'kickback', or 'to the common pot' without assessing humorous intent. No single public list of flagged phrases exists, as each bank independently configures its monitoring algorithms. Even routine descriptions such as 'for manicure' or 'utilities payment' may raise flags when combined with regular amounts or recurring patterns. Valishvili advises private individuals to omit unnecessary comments and to reference specific contract numbers and dates when a transfer has legal significance. For group collections, she recommends using bank-provided tools that clearly state the purpose of the payment.
How to Secure Your Gosuslugi Account Against Hacks and Recover Access After Takeover
Russia's Gosuslugi portal now holds far more than basic documents, including tax notifications, child records, data-sharing consents, and access to other government services, making account security critical. The guide stresses using a unique strong password, enabling two-factor authentication with TOTP or biometrics instead of SMS, and regularly reviewing active sessions and connected mobile apps. It details steps to add a trusted contact for recovery, audit consents granted to third parties, and monitor for unauthorized logins or statements. In case of suspicious codes or calls, users must never share verification codes and should immediately check actions in the system, revoke unknown consents, and contact support. If access is lost, recovery options include online password reset with passport data or in-person visits to service centers, followed by credit history checks and self-imposed credit bans via Gosuslugi starting March 2025. The advice also covers protecting the linked phone number and email to prevent SIM swaps and further fraud.
Scammers Impersonate Social Fund to Threaten Child Benefit Cancellation and Steal Savings
Fraudsters have launched a new social engineering campaign targeting parents by impersonating officials from Russia's Social Fund. Callers claim that suspicious transfers have been detected on family accounts and threaten the cancellation of child benefits unless savings are moved to a special transit account. The scheme relies on fabricated rules about income assessment and uses the promise of an 'unreported' account to trick victims into sending money. The Narodny Front's Moshelovka platform, cited by RIA Novosti, confirms that the Social Fund never requests transfers to third-party accounts for benefit verification. Families are instructed to check official notifications exclusively through Gosuslugi or by visiting an SFR office in person. Authentication codes from government services or banking apps must never be shared over the phone.