PSA: Fake Job Scam Targeting Developers

Got contacted about a "simple payment app" backend job ($90/h).

After getting repo access, found malware that:

• Steals browser passwords & crypto wallets
• Exfiltrates AWS/GCloud credentials & .env files
• RAT with remote command execution

Red flags:

• Vague project details, no call before "finalization"
• React.js listed as backend requirement
• 1 commit repo with suspicious npm scripts

Stay safe out there.