The Absurd #4: The Video That Wasn't

Dear reader,

This week I was hacked through a job interview, and I want to tell you exactly how, because it can happen to you. It is called fake job interview malware: someone poses as an employer, builds your trust over a few friendly messages, and then, during the interview, asks you to run something on your own computer. I ran it. I am writing this so that you do not.

How a fake job interview malware attack found me

It started with a kind email. Someone signing as Abigail Alano, HR Manager at SkyArk, wrote from hr.alano@skyarkchronicle.com. The email said they had found my work on GitHub while looking for people with blockchain and Web3 experience. SkyArk, it said, was a Singapore-based company building a blockchain staking platform and 3D games, the role was remote, full-time or part-time, and there was "no pressure either way."

I said I was interested and sent my profile. Abigail sent a whitepaper. I read it, and asked for an interview with their Tech Manager. Abigail asked if I was free the next day and sent a Calendly link. I booked it, and an invitation came back from Denmark Jay, denmark@skyarkchronicle.com, for a 30-minute Google Meet titled "Discussion on Skyark Chronicles' Project."

Everything about it was normal. The emails were polite, quick, and carried a company logo. Every step was a small, reasonable yes.

Then, in the interview, Denmark asked me to run some commands, the kind developers run every day. Download our project. Switch to the branch called video, where the demo videos are. I did. The folder had two files, game-video.mp4 and staking-video.mp4.

The video that wasn't

When the call was over, I asked my AI assistant, Claude Code, to open the video for me so I could watch it. Instead of opening it, it looked at what had happened in that folder, and stopped.

Neither file was a video. The first was empty. The second was a short text file of settings, renamed to end in .mp4. The videos were bait. The real work had already happened, at the moment I switched branches.

Here is the trick, in plain words. Git, the tool almost every developer uses to download and track code, can run small scripts called hooks when you do certain things, like switching branches. The project I downloaded had a hook that ran on every branch switch. At the top it had a harmless-looking comment, "Run your own local work in the background (example; disabled)", and then dozens of blank lines, so anyone opening the file would see nothing and close it. Below the blank lines was one line that fetched a script from a site called vantaralabs.online and ran it, with versions ready for Mac, Linux and Windows.

That script started a hidden program in a temporary folder. The program downloaded about 4.5 megabytes of code and ran it straight from memory, then connected to a server the attackers controlled. It was built to read the files where developer tools keep their keys: the passwords that let programs talk to other services.

The real SkyArk game studio's website, skyarkchronicles.com, has been registered since 2021. The domain the emails came from, skyarkchronicle.com, without the "s", was registered on 25 September 2026, about a month before Abigail wrote to me. And vantaralabs.online, where the hook fetched its code, was registered on 28 October 2026, the day before my interview.¹

So I am naming them. If Abigail Alano, hr.alano@skyarkchronicle.com, or Denmark Jay, denmark@skyarkchronicle.com, writes to you about a Web3 role at SkyArk, do not run anything they send you.²

What it cost, and what it did not

Claude stopped the hidden program and confirmed it was gone. Then we spent the night doing what you do after a break-in: listing what was in the house.

Some things were safe. macOS keeps its most sensitive secrets, such as saved browser passwords and the logins of some apps, in a locked vault called the Keychain, and a program cannot open it without asking for my password. No password prompt ever appeared, so those stayed locked.

Other things could not be assumed safe. Any key in a plain file on my Mac could have been read, and reading leaves almost no trace. So we treated every one of them as stolen, and started replacing them, service by service: the keys that send email, take payments, call AI models and run the blogs and admin pages of our sites. After each change we tested every site again, to make sure the new keys worked and the old ones were refused.

That is the real cost of one command: not a lost file, but hours of careful, boring work with no room for a mistake.

Why this is absurd

The absurd, for Camus, is the gap between what we expect from the world and what it gives back.

Here is the gap. I build software with AI every day, and AI made this week's recovery possible: work that once needed a team, done by one person and an assistant. The same abundance is on the other side of the table. A polite, patient, well-written recruiter used to cost a scammer real hours. Now a thousand of them can be written for the price of one, each one personal, each one quoting your own GitHub back to you.

This is not new. Researchers at Palo Alto Networks' Unit 42 named this pattern "Contagious Interview" in 2023: attackers posing as employers to get software developers to run their code during an interview, which Unit 42 attributes, with moderate confidence, to a North Korean state-sponsored group.³ What is new is how cheap the friendliness has become.

I used to think the next step, AI agents that hack on their own, was still ahead of us. It is not. In November 2025, Anthropic reported that attackers had used its own Claude Code against about thirty targets, with the AI doing, by Anthropic's estimate, 80 to 90 percent of the work.⁴ That was a state-backed group; the same tools will reach the people who write to developers like me. That is the absurdity of this moment: the tool that saved me and the tool that will be used against us are the same kind of thing.

What I should have listened to

The Stoics split the world into what is in our control and what is not. Who writes to me is not in my control. What I run on my own computer is.

Looking back, I felt that some things did not add up, from their web page to the way their "HR" replied, which felt more like an agent working through a script than a person. I ignored that feeling, because each step on its own was reasonable, and because a developer runs commands all day. Trust does not come from one big promise. It comes from many small, reasonable yeses, and then one more.

So, dear reader, here is what I am taking away:

1. Listen to the small feeling that something is off. It was right, and I overrode it.

2. Never run a command you do not understand, especially one handed to you by someone else. An interview, a support call and a "quick test" are all the same here.

3. Ask an AI to read it before you run it. Ask an assistant what the command or project does and what it touches. It costs a minute.

4. Treat a downloaded project as a stranger. Look inside its hidden .git/hooks folder, and test strangers' code on a spare machine.

5. If it happens anyway, assume every key on that machine is stolen, and replace them, starting with the ones that can spend money or send email.

If I had opened that "video" myself, I might never have known. I asked my assistant to open it, and it looked first. That habit, looking before running, is the whole lesson.

Questions I am living with

• If trust is built from small reasonable yeses, and a machine can write every one of them, how do we decide who to trust?

• When attackers have AI agents too, is the defence a better agent, or a slower human?

• How many people ran the same command this week, and never asked anyone to open the video?

Frequently asked questions

What is fake job interview malware?

It is an attack where someone poses as a recruiter or employer, builds your trust, and then asks you to download a project or run a command during the interview. The project carries a hidden program that steals keys and passwords from your computer.

How did the attack run without me opening any file?

The project used a git hook, a script that git runs on its own when you do certain things, such as switching branches. Switching to the branch called video was enough to start it.

How can I check a project before I run it?

Look inside its hidden .git/hooks folder, and ask an AI assistant to read the project and any command you were given and tell you what it does.

What should I do if I already ran something like this?

Stop the program, disconnect it, and assume every key and password stored in plain files on that computer is stolen. Replace them one by one, starting with the ones that can spend money or send email, and test each service after.

Until the next absurdity,

Miguel