Security researchers have exposed a fake hiring company that turns job applications into malware infections. JFrog Security Research says the fictitious firm, AccuraSoftHire, runs a working careers website and uses identity-verified recruiters, then infects developers through a poisoned take-home coding test and a bogus 'camera driver'. The research was published on 9 November and reported on 11 November. ## A fake company built to pass every check The domain, accurasofthire.com, was registered at Hostinger on 17 April 2026. Its React careers portal has an About page, a leadership page, client testimonials and twelve remote roles. Its first advert, for a senior MERN developer, was recorded on 25 June 2026, and its adverts also appeared on Indeed, Glassdoor and SimplyHired. Its LinkedIn page lists the company as an IT services and consulting firm based in Tonopah, Arizona, with 93 followers. Three recruiters carry the grey shield LinkedIn shows when a verification partner has checked a member's government ID. But all three joined LinkedIn in 2026, in consecutive months, each verified within weeks of joining. The chief operating officer's job at the firm begins before the domain existed, and its stated location changes from page to page: Tonopah, Oregon, Georgia and Kyiv. ## The poisoned take-home test Candidates are sent a link to a repository holding a React and Redux landing page. The project's Tailwind configuration loads eleven plugins. Ten of them are real. The one in the middle, tailwind-custom-forms, is a copy of the official @tailwindcss/forms plugin with a malware loader pasted onto the end of its file. Nothing about it runs at npm install, so there is no install script for a scanner to flag. The loader runs when Tailwind builds the CSS, and building the CSS is the first thing the task tells the candidate to do. Each time npm took a copy down, the operator named a new copy in the task's configuration. One email address gives the operation away. The Gmail address handy.apple117@gmail.com signs the commits of GitHub account oleksandr3201 ('Project Manager @ AccuraSoftHire') and owns npm account sun117, which published one of the loader packages. In JFrog's assessment, the recruiter, the task author and the package publishers are one operation. ## The camera driver that installs malware The careers site has a second delivery path. Step two of the application is 'video verification', in which the candidate records a short clip in the browser. The check is scripted to fail: it shows 'Checking for a camera...' for six seconds and then reports that the camera environment is not compatible, because the browser only asks for the camera once the server says the 'driver' is installed. The fix is on a page headed 'Technical onboarding', which gives curl commands to download CameraDriverUpdate.msi, a Mac zip or a Linux .deb file. JFrog took the installers apart in a sandbox. They are thin droppers that fetch a bootstrap script from the careers site and run it. The Windows installer downloads a 13 KB payload.js, runs it, deletes it, tells the server, and deletes itself. The payload reads server addresses from a recent Ethereum transaction, then fetches two further stages. JFrog stresses that it found no link between AccuraSoftHire and the theft from the Binance exchange, in which Binance says a fake job interview was a key step. Binance says about 6.34 billion dollars left its hot wallets on 29 October, and that the FBI has attributed that attack to North Korea. ## How developers can protect themselves JFrog's advice is blunt: treat a take-home assignment as untrusted code from a stranger. Open unknown projects in VS Code's restricted mode and read .vscode/tasks.json before trusting the folder. Run it in a throwaway virtual machine or container with no tokens, keys or wallets. No legitimate employer needs a 'camera driver', and none delivers a 'recommended VS Code configuration' as a curl command. A LinkedIn verification badge confirms that a government ID was checked; it says nothing about the company. Fake-interview campaigns, tracked as 'Contagious Interview', date back to 2023, and a September advisory counted at least 30,000 infected machines. Read the full JFrog research at [JFrog Security Research](https://research.jfrog.com/post/accurasofthire-fake-interview/) and the coverage at [The Hindu BusinessLine](https://www.thehindubusinessline.com/info-tech/jfrog-flags-fake-job-interview-scam-masquerading-as-hiring-platforms/article71688283.ece). ## Frequently asked questions **What is AccuraSoftHire?** A fictitious hiring company exposed by JFrog. Its careers site, job adverts and ID-verified recruiters look real, but its coding tests and 'camera driver' deliver malware. **How does the take-home test infect a computer?** One of the eleven Tailwind plugins in the test's configuration is a poisoned copy of a real plugin, and its loader runs when Tailwind builds the CSS, the task's first step. **Is AccuraSoftHire behind the Binance theft?** No. JFrog found no connection between AccuraSoftHire and that intrusion, in which Binance says a fake job interview was one step.