Job offer safety guide

Fake recruiter or real job? The chat is bait, the second step is the attack

The job offer is the bait; the requested action is what matters. A friendly LinkedIn chat can lead to a malicious meeting page, a coding task, a wallet approval or a fake login. The FBI and Unit 42 have documented employment-themed attacks against crypto workers and developers. Use the checks below before taking that next step — not after your accounts start doing overtime for someone else.

Check an address free

Four traps and one independent check

Meeting link → fake update

A page resembling Zoom, Meet or Teams says you need a codec, plugin or browser update. Stop: do not install it or paste commands into a terminal. Open the meeting service yourself and enter the meeting ID. If an app update is needed, get it through the app or its official download page, not the recruiter's link.

Test task → code execution

A supposed presentation may be an executable such as Job_Description.pdf.exe. A coding repo can run scripts during dependency installation, before you launch the project. Ask for a browser-readable brief first. Never install or run unreviewed interview code on a device containing work accounts, passwords or wallet keys.

Candidate portal → wallet permissions

A portal asks for a wallet connection or signature to 'verify experience'. Connecting alone is not the same as approving a transfer, but the next transaction or Permit signature may authorize token spending. Do not use your personal wallet for hiring verification. For a confirmed technical exercise, request a testnet task with test tokens instead.

Scheduling page → stolen login

A scheduling or document page demands a Google or LinkedIn login. Check the actual address bar, not a logo or a popup drawn inside the page. Google authentication uses accounts.google.com. Even a genuine consent screen can request excessive access: reject permissions unrelated to booking an interview and open the service independently.

Agency website → verify the employer, not the polish

A polished agency site is not independent proof of a vacancy. Its Apply, download and booking buttons can lead to the four traps above; its forms can also harvest personal data. Find the hiring company's official contact yourself and ask whether the role and agency are authorized. A missing public listing does not prove fraud: confidential searches exist. Withhold identity documents, your home address and financial details until the employer and purpose are verified.

Pressure signals — not proof on their own

A high salary paired with vague responsibilities and no identifiable hiring manager.
An artificial deadline that leaves no time to verify the offer.
Refusal to let you confirm the agency or role with the employer independently.
Requests to pay a recruitment fee, buy equipment from a specified seller or transfer crypto to unlock the job.

Practical checks before the next step

1.Paste the recruiter's message into our free AI Scam Detector to look for scam patterns and highlighted warning signs in the text. Remove personal details first. It does not verify the recruiter's identity; no detected flags is not a safety guarantee. Check the recruiter's message
2.Use this reply: "Please send the job brief and meeting ID from your corporate email, and tell me whom I can contact at the hiring company to confirm the role." A corporate email is an extra check, not proof: real accounts can be compromised.
3.Show full file extensions in your system settings. Scan unfamiliar public links with VirusTotal, but do not upload confidential documents or private invitation URLs. A clean result only means the scanners did not flag it; new attacks can pass undetected.
4.Check the domain's registration date at lookup.icann.org and compare it with the agency's claimed history. A new domain deserves further checks; privacy-protected registration is common and is not proof of fraud. An old domain can also be compromised.
5.If a verified technical task needs execution, use a disposable isolated environment with no secrets, shared folders, clipboard sharing or access to your normal accounts. A separate browser profile does not isolate malware from the computer. If you cannot set this up safely, ask for a different assessment.

Already happened? First steps

Send nothing more and sign nothing new.
Save the transaction hash, the addresses and chat screenshots.
Report it today through official channels; never pay 'recovery' services.

Where to report crypto theft

Questions people ask

Can an AI-written vacancy prove a scam?

No. Legitimate employers also use writing tools and site builders. Judge the requested actions and independently confirmed employer, not the prose style.

I clicked a link but did nothing else. What now?

Close the page and check whether anything downloaded. Do not open the download. A click alone does not establish account theft; if you entered a password, granted access or executed a file, follow the relevant response below.

I entered a password or granted account access. What now?

From a trusted device, change the affected password, end active sessions and remove unfamiliar connected apps or OAuth permissions. Change reused passwords too and enable two-factor authentication. Notify your workplace security team if a work account was involved.

I ran code or approved a wallet request. What now?

If you ran suspicious code, disconnect that device and use a clean one for recovery; treat secrets stored on the affected device as potentially exposed. For a token approval, revoke the affected permission using a trusted tool. If wallet keys or the recovery phrase were exposed, revocation is not enough: move remaining assets to a newly created wallet on a clean device. Save evidence and report through official channels.

Keep reading

Sources

North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks (FBI / IC3, 3 September 2024)
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors (Palo Alto Networks Unit 42, November 2023)

Educational information only — not financial or legal advice.