Threat Intelligence | Analysis of a GitHub Poisoning Attack Disguised as Recruitment

Background Recently, MistEye detected a malicious code delivery campaign targeting developers under the guise of recruitment. The attacker first contacted developers via LinkedIn, posing as a recruiter from a Web3 project. After discussing the target’s work experience and interview arrangements, the attacker sent the target a GitHub repository, claiming it contained the MVP that needed to be tried before the interview. The chat logs show that the attacker first asked about…

Diamond Model