The IT job market has turned increasingly turbulent due to economic instability, mass layoffs, reduced vacancies, and widespread AI adoption that threatens to replace developers. This uncertainty pushes specialists to test their market value or seek new roles after cuts, with searches sometimes lasting months or years.
These pressures make candidates more willing to accept questionable requirements, lower salaries, or endless hiring stages. As a result, scam vacancies have proliferated. Attackers exploit fears and anxieties, and current conditions create ideal conditions for such schemes.
Drainer scam originally referred to theft of private keys from crypto wallets, allowing attackers to drain all valuable assets including cryptocurrency, tokens, and NFTs. The technique has migrated to recruitment: fake recruiters contact candidates and propose applying for a role. Variations include asking candidates to complete test tasks by cloning projects from private repositories, join corporate applications that require installing malicious browser extensions, or share screens during calls while being instructed to download and run code.
Particularly motivated scammers conduct real video calls, ask relevant technical questions, and maintain the appearance of legitimate interviews. Rumors suggest involvement of operatives from a closed Asian country with a leader whose name begins with “Kim,” sometimes using AI deepfakes to alter appearance while retaining noticeable accents.
First signs of deception often appear when an HR message arrives unsolicited on a job site. Modern markets have reversed the dynamic: candidates now apply en masse while recruiters receive hundreds of responses. Superficial questions without follow-ups or immediate confirmation that a candidate fits the salary range should raise alarms, as genuine recruiters probe technical fit, team compatibility, and motivation.
Verification steps include checking LinkedIn profile history and real professional connections, confirming the company website and corporate email, and ensuring consistency between the vacancy, communication, and technical task. Multiple red flags together warrant caution.
Before running any repository, inspect package.json, lock files, .npmrc, install scripts, and CI/CD configurations on GitHub. Look for suspicious dependencies, obfuscated code, secret references, or unexpected network calls. Use AI assistants such as Copilot or Claude for static analysis without installing dependencies.
If execution is unavoidable, run the code in an isolated environment without personal keys, passwords, or sensitive files. After any suspected compromise, audit the system, rotate credentials from a clean device, revoke tokens, and review account activity.
The author personally lost approximately 2000 USD in cryptocurrency after completing a test task involving crypto payment integration. The assignment arrived via Google Docs rather than a repository branch, and communication occurred through a translator. Similar scams have since multiplied, prompting the author to engage with them deliberately in controlled environments to study evolving tactics.
