This guide shows you how to check a recruiter, join interviews without installing anything they send, open take-home "test projects" safely, and set up your computer so a booby-trapped project can't run on its own. It also covers what to do if you already ran something. Setup takes about 30 minutes, and the checks become a 5-minute habit for every new offer.
Why bother
Since at least 2022, organised groups have posed as recruiters for crypto, Web3 and AI companies. The offer is excellent and the process looks real. Then you're asked to install a "meeting app", run a coding test, or paste a command to "fix your camera". Doing it installs malware that steals saved passwords, session cookies, crypto wallets, seed phrases, password-manager files and API keys. Microsoft, ESET and Unit 42 have documented these campaigns on Windows, macOS and Linux, aimed mostly at developers and freelancers.
Before you start
- Time: about 30 minutes for the setup steps (3 to 6). Steps 1, 2 and 7 are habits.
- You need: admin access to your computer. If you write code, you also need VS Code and Node.js/npm. For Step 3, a free virtual machine app such as VirtualBox (Windows, Linux, Intel Macs) or UTM (Apple silicon Macs) is useful.
- Checked on: VS Code 1.109 and later (Workspace Trust docs dated 28 October 2026), npm 11, macOS Tahoe 26.4 and later, macOS Sequoia, Windows 11.
- Backup: the setup steps erase nothing. The cleanup in Step 9 includes reinstalling your operating system, which erases everything, so back up your documents first.
Steps
1 Verify the recruiter before you reply
- Search the recruiter's name and the company name, each with the words
scam,reviewandcomplaint, as the FTC recommends. - Find the company's real website yourself, without using the link they sent you. Check that the job is on its careers page and that the recruiter's email uses the company's own domain, not Gmail, Outlook or a lookalike spelling.
- On LinkedIn, check the recruiter's profile age, real connections and verification badge. A missing badge doesn't prove a scam, but a brand-new profile with few posts is a warning sign.
- Write to the company through its official contact address and ask whether this person works there.
- Be suspicious if the conversation moves to Telegram, Discord or WhatsApp, or if the pay is well above market for very little screening.
You should now have either independent confirmation that the person is real, or a reason to stop. To report a fake on LinkedIn (desktop), open their profile and click More > Report / Block, choose This account is not a real person or This person is impersonating someone, then click Submit report.
2 Never install a meeting app from a recruiter's link
Real interviews use tools you already know: Zoom, Microsoft Teams, Google Meet or Webex. All of them can be joined in a web browser or through an app you downloaded yourself from the vendor's own site or your app store.
- If the invite names an app you've never heard of, ask for a Zoom, Teams or Meet link instead. A real recruiter will agree.
- If the link takes you to a page that says you must download a client to join, close the tab.
- Never follow instructions to use
System Settings > Privacy & Security > Open Anywayfor a meeting app. Apple says to use that button only when you're sure the app is trustworthy, and software from a stranger's link never qualifies.
These tells come from documented cases:
- The brand is unfamiliar or newly made. Reported examples include Meeten, Clusee, Cuesee, Meetone and Meetio, plus a cloned MiroTalk site.
- On a Mac, the app says it "is not fully compatible with your version of macOS" and asks for your Mac password before it will work.
- Afterwards it shows an error and asks you to reinstall or use a VPN, while it copies your data in the background.
- macOS blocks the app, and the recruiter sends instructions for getting around the block.
You should now be joining interviews only through software you installed yourself.