Fake-Developer-Recruitment on ThreatProphethttps://threatprophet.com/tags/fake-developer-recruitment/Recent content in Fake-Developer-Recruitment on ThreatProphetHugo -- 0.161.1en-usSun, 17 May 2026 00:00:00 +0000AI-Powered RWA Finance Platform: Developer Review ZIP Uses Git Hooks to Stage a Tri-Port JavaScript Implanthttps://threatprophet.com/posts/2026-05-17-ai-rwa-finance-platform/Sun, 17 May 2026 00:00:00 +0000https://threatprophet.com/posts/2026-05-17-ai-rwa-finance-platform/Analysis of a recruitment-themed developer review lure that abused LimeWire file sharing to deliver an AI/RWA finance platform ZIP containing malicious Git hooks, cross-platform Node.js staging, and an obfuscated JavaScript implant with 8085/8086/8087 C2 roles.Kryptic Haven-Branded Git Challenge: Malicious Hooks Deliver Gurucooldown Payload Chain and Multi-Module JavaScript Backdoorhttps://threatprophet.com/posts/2026-05-17-kryptic-haven/Sun, 17 May 2026 00:00:00 +0000https://threatprophet.com/posts/2026-05-17-kryptic-haven/Analysis of a Kryptic Haven-branded LinkedIn hiring lure that delivered weaponized Git challenge archives with local hooks, Short.io-staged payloads, and a multi-module JavaScript backdoor targeting browsers, wallets, files, clipboard contents, and remote command execution.