How a Fake Job Interview Pwnd Binance with a Single Git Checkout Command
Think a technical test interview is safe? Binance learned the hard way that a malicious zip file containing a hidden Git hook can turn a simple branch switch into full remote code execution.
When a software engineer at Binance received a test project for a new role, they probably expected a routine coding puzzle. Instead, executing a seemingly innocent branch switch triggered a background script embedded straight into the repository's metadata. Rather than relying on traditional installation scripts, the attack weaponized local Git hooks to quietly fetch a massive obfuscated JavaScript payload.
The Multi-Stage Payload Mechanics
The extracted code carried a complete arsenal including browser data scrapers, file hunters, and an interactive remote shell communicating via Socket.IO. By leveraging official runtime downloads from Node.js and executing through hidden background workers, the mechanism managed to bypass standard visual checks. Even though password decryption routines appeared stubbed out, the collector aggressively targeted local credential stores, browser extensions, and active user sessions.
The Persistence Trap
Persistence wasn't left to chance, utilizing custom launch agents alongside the repository's intrinsic hooks to ensure longevity. Investigators noted that the infrastructure heavily relied on hardcoded IP addresses and HMAC-signed telemetry rather than complex domain obfuscation. While attribution pointed toward state-sponsored actors via telemetry from the FBI and Chainalysis, the sheer elegance of exploiting developer trust remains the most alarming takeaway.
Source: Binance Blog
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.