Skip to navigation

Threat reportMalwareTL-2026-5981

AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

highACTIVE

A fake-recruitment operation (AccuraSoftHire) gives developers a take-home React test whose Tailwind config loads a malicious look-alike npm plugin, then pushes a fake camera 'driver' and a 'job alerts' browser extension. The PolinRider-family loader resolves its C2 address from an Ethereum wallet (NullReceiver dead-drop) and downloads further Node.js stages; the method matches North Korea-linked Contagious Interview tradecraft, but JFrog found no link to the Binance October 29 intrusion.

Key facts

IdentifiersTL-2026-5981
Also known asAccuraSoftHire, NullReceiver
SeverityHIGH
First disclosed
Affected productsnpm (registry) Tailwind CSS look-alike plugins (tailwind-lines-clamps, tailwind-lineclamp, tailwind-forms-kit, tailwind-custom-forms, tailwind-clamps-line, tailwind-form-styles, tailwindcss-contact-forms, tailwind-anim, tailwindcss-anim, scrollbar-hide-plugin); npm (registry) cdeops, @adminide-stack/utils; Multi-platform Developer workstations (Windows, macOS, Linux) running Node.js, VS Code, Chrome or Edge
AttributionContagious Interview (medium confidence)
Nation-state nexusNorth Korea
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.004 Unix Shell, T1059.007 JavaScript, T1071.001 Web Protocols, T1140 Deobfuscate/Decode Files or Information, T1176.001 Browser Extensions, T1195.002 Compromise Software Supply Chain, T1204.002 Malicious File, T1552.004 Private Keys and 5 more in the attack flow
MotivationFINANCIAL
Target sectorstechnology, software development, finance, cryptocurrency
Target regionsGlobal
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5981 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: AccuraSoftHire — Look-alike Tailwind/npm Package Installed or Written to node_modules (PolinRider Loader)

Detects the AccuraSoftHire take-home-test supply-chain vector (TL-2026-5981): a developer machine installing or materializing one of the malicious Tailwind look-alike npm packages (tailwind-custom-forms, tailwind-lines-clamps, tailwind-lineclamp, tailwind-forms-kit, tailwind-clamps-line, tailwind-form-styles, tailwindcss-contact-forms, tailwind-anim, tailwindcss-anim, scrollbar-hide-plugin) or the flagged cdeops / @adminide-stack/utils packages (MAL-2026-18643). The PolinRider-family loader runs when Tailwind builds CSS, not at npm install, so there is no install script to flag; the package name in a process command line or a node_modules file write is the earliest reliable signal. Matches on exact package-name boundaries to avoid hits on legitimate plugins such as tailwindcss-animate.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1195.002, T1204.002, T1059.007, T1656
  • Data sources: sysmon, windows_process_creation, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h (EventCode=1 OR EventCode=11)
| eval artifact=coalesce(CommandLine, TargetFilename)
| where match(artifact, "(?i)(node_modules.| |^)(tailwind-custom-forms|tailwind-lines-clamps|tailwind-lineclamp|tailwind-forms-kit|tailwind-clamps-line|tailwind-form-styles|tailwindcss-contact-forms|tailwind-anim|tailwindcss-anim|scrollbar-hide-plugin|@adminide-stack.utils|cdeops)([^a-z0-9._-]|$)")
| eval evidence=if(EventCode=1, "package_in_process_commandline", "package_written_to_node_modules")
| stats count min(_time) as first_seen max(_time) as last_seen values(artifact) as artifacts values(ParentImage) as parent_images by host, User, Image, evidence
| convert ctime(first_seen) ctime(last_seen)
| table host User Image evidence count first_seen last_seen artifacts parent_images

Microsoft KQL

let lookalikeRe = @"(?i)(node_modules.| |^)(tailwind-custom-forms|tailwind-lines-clamps|tailwind-lineclamp|tailwind-forms-kit|tailwind-clamps-line|tailwind-form-styles|tailwindcss-contact-forms|tailwind-anim|tailwindcss-anim|scrollbar-hide-plugin|@adminide-stack.utils|cdeops)([^a-z0-9._-]|$)";
union
    (DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine matches regex lookalikeRe
    | project Timestamp, DeviceName, Account = AccountName, Evidence = "package_in_process_commandline", Process = FileName, Artifact = ProcessCommandLine, Parent = InitiatingProcessFileName),
    (DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("FileCreated", "FileModified")
    | where FolderPath matches regex lookalikeRe
    | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Evidence = "package_written_to_node_modules", Process = InitiatingProcessFileName, Artifact = FolderPath, Parent = InitiatingProcessParentFileName)
| summarize Events = count(), First = min(Timestamp), Last = max(Timestamp), Artifacts = make_set(Artifact, 10) by DeviceName, Account, Process, Evidence

Sigma

title: AccuraSoftHire Look-alike Tailwind npm Package in Process Command Line
id: 7c1f3a52-8e41-4b6d-9a27-5d0c1e8f2a01
status: experimental
description: Detects npm/yarn/pnpm or node process command lines that reference the malicious Tailwind look-alike packages or cdeops / @adminide-stack/utils tied to the AccuraSoftHire fake-interview campaign (PolinRider-family loader, TL-2026-5981).
references:
    - https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines
    - https://research.jfrog.com/post/accurasofthire-fake-interview/
    - https://osv.dev/vulnerability/MAL-2026-18643
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1204.002
    - attack.t1059.007
    - attack.defense-evasion
    - attack.t1656
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|re: '(?i)(node_modules.| |^)(tailwind-custom-forms|tailwind-lines-clamps|tailwind-lineclamp|tailwind-forms-kit|tailwind-clamps-line|tailwind-form-styles|tailwindcss-contact-forms|tailwind-anim|tailwindcss-anim|scrollbar-hide-plugin|@adminide-stack.utils|cdeops)([^a-z0-9._-]|$)'
    condition: selection
falsepositives:
    - Security researchers or package-registry analysts pulling these packages in a sandbox
    - Vulnerability scanners that echo package names in command lines
level: high

Known false positives:

  • Security researchers or registry analysts installing the packages in an isolated sandbox
  • Software composition analysis or inventory tools that print package names in command lines

Tuning notes: Exclude known research/sandbox hosts by host or user. Extend the package list as JFrog/StepSecurity publish new look-alikes; the exact-name boundary match avoids hits on legitimate plugins such as tailwindcss-animate. Pair with lockfile review, since the loader fires at Tailwind build time rather than install time.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • AccuraSoftHire — ClickFix Fake Camera Driver Download and Install Chain · unlock with TL Creds
  • AccuraSoftHire — Native Messaging Host, Scheduled Task and Unpacked Extension Persistence · unlock with TL Creds
  • AccuraSoftHire — C2 and Stage Retrieval Connections to Wallet-Decoded IPs and Campaign Infrastructure · unlock with TL Creds
  • AccuraSoftHire — Obfuscated eval(atob()) Node Loader and A10 Build Markers · unlock with TL Creds
  • AccuraSoftHire — Bootstrap and Setup Script Execution ([indicator], .nvm bootstrap.cmd, curl to cmd) · unlock with TL Creds
  • AccuraSoftHire — VS Code Workspace Task Auto-Run Spawning Shells That Fetch Remote Content · unlock with TL Creds
  • AccuraSoftHire — Node.js Process Reading Browser, Wallet, SSH, Cloud and Git Credential Stores · unlock with TL Creds
  • AccuraSoftHire — Node.js Dead-Drop Lookup to Ethereum Endpoints (NullReceiver C2 Resolution) · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 34 indicators of compromise for TL-2026-5981.

Sample indicators (3 of 34)

  • IP address: 103.179.142[.]155
  • Domain: accurasofthire[.]com
  • IP address: 23.27.13[.]72

Defanged, TLP:CLEAR. Full set of 34 indicators: unlock with TL Creds.

34 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration

2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

StepSecurity (2026-11-13) and JFrog Security Research (2026-11-09) document AccuraSoftHire, a fake company with a careers site (accurasofthire.com, registered 2026-04-17), job ads on Indeed, Glassdoor and LinkedIn, ID-verified recruiter profiles and a GitHub organization. Candidates complete two interviews and receive a take-home React landing-page repository. The project's Tailwind configuration loads a trojanized look-alike of a Tailwind plugin (e.g. tailwind-custom-forms, a copy of @tailwindcss/forms with a loader appended). The loader executes when Tailwind builds CSS, not at npm install, so no install script exists to flag. Ten look-alike packages published by the npm accounts goss1000, sun117, evaward1, georgeodom1 and helmets were identified; some (tailwind-lines-clamps, first published 2026-04-16, and tailwind-lineclamp) stayed installable for months. Malicious versions of cdeops and @adminide-stack/utils (OpenSSF MAL-2026-18643) were flagged by GitHub on 2026-11-04.

The careers site then stages a ClickFix-style social-engineering step: a camera-compatibility check fails after about six seconds without ever calling getUserMedia, and the /vscode-setup page builds a curl command per user agent that fetches CameraDriverUpdate.msi, CameraDriverUpdate-mac.zip or CameraDriverUpdate.deb from /camera-driver/setup-win|mac|linux. On Windows the bootstrap (/camera-driver/bootstrap-win?flag=10) installs Node.js if missing (%USERPROFILE%\.nvm\bootstrap.cmd), downloads /camera-driver/payload.js, runs it hidden, deletes it, calls /camera-driver/ack and deletes itself; macOS/Linux use the same flow in bash with nohup and delayed self-delete. A second path has the candidate load an unpacked 'job alerts' extension (extensions/job-new-alerts), run setup-full-windows.ps1 with execution policy bypassed, and register the native messaging host com.accurasoft.jobalerts for Chrome and Edge; the host runs curl piped to cmd against /notification-settings-win, and a scheduled task polls the site every five minutes. As of 2026-11-02 that bootstrap ran an empty node -e "" payload slot. A .vscode/tasks.json with runOn folderOpen is also an artifact to hunt.

The loader (PolinRider family, build markers A10-online, A10-npm-handy, A10-new_npm, A10-npm_inject; also sent in a Sec-V header) is obfuscated as a base64 string array passed to eval(atob(...)). It queries the Ethereum transaction history of sender 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a via eth.blockscout.com (other reporting names 1rpc.io/eth and eth.drpc.org), takes the newest transaction and decodes the C2 IP from the recipient address bytes (the 'NullReceiver' technique; the recipient also carries the ASCII string 'helloipbot!!'). It then fetches two stages over plain HTTP on port 443 from /0x/cls (run in-process) and /0x/ls (run as a detached Node process), XOR-decoded with hardcoded keys. StepSecurity reports the loader steals browser credentials, cryptocurrency wallet data, SSH keys, cloud credentials and git credentials, and uses stolen git credentials to inject the loader into other repositories while rewriting commits to preserve original dates. JFrog notes it did not analyze the stage payloads, so specific theft targets come from StepSecurity.

Attribution: the vector follows the North Korea-linked Contagious Interview playbook, and attribution rests on shared indicators with PolinRider and ClickFake (A10 markers, /0x/cls and /0x/ls paths, camera-check method). A joint advisory of 2026-09-18 (FBI, DC3, Japan, Australia, Germany) attributes fake-interview campaigns to North Korean actors with 30,000+ devices infected across 100+ countries. Binance, citing the FBI, attributes its 2026-10-29 theft (about $6.34B) to North Korea and says it began with a fake interview assignment; JFrog found no link between AccuraSoftHire and that intrusion.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1684.001 Impersonation

Persistence

T1053.005 Scheduled Task; T1176.001 Browser Extensions

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.004 Unix Shell; T1059.007 JavaScript; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols

Initial Access

T1195.002 Compromise Software Supply Chain; T1566.003 Spearphishing via Service

Credential Access

T1552.004 Private Keys; T1555.003 Credentials from Web Browsers

Resource Development

T1583.001 Domains; T1585.001 Social Media Accounts

Remediation

Immediate actions

  • Search developer machines and node_modules for the listed npm packages (any version other than npm's 0.0.1-security placeholder is malicious), cdeops, @adminide-stack/utils, CameraDriverUpdate.* files, %USERPROFILE%\.nvm\bootstrap.cmd, the com.accurasoft.jobalerts native messaging host and extensions/job-new-alerts
  • Search network and proxy logs for accurasofthire.com, the eight C2 IPs, the /0x/cls and /0x/ls paths and the Sec-V request header
  • If infected, rotate every credential on the machine (browser, wallet, SSH, cloud, git) and audit repositories for injected loader code and rewritten commits; wiping the laptop alone may not stop reinfection

Workarounds

  • Set VS Code task.allowAutomaticTasks to off, keep Workspace Trust enabled, open unfamiliar projects in Restricted Mode and review .vscode/tasks.json before trusting a folder

Longer-term hardening

  • Prohibit external coding assignments, drivers or setup commands on work machines; run interviews in a disposable VM with no tokens, SSH keys, wallets or browser profiles
  • Use a package registry cooldown for newly published versions (it will not stop long-lived malicious packages)
  • Monitor CI build egress for calls to public Ethereum endpoints (e.g. eth.blockscout.com) and plain HTTP to bare IPs on port 443
  • Compare lockfile resolution dates with commit dates

Affected and fixed versions

  • npm (registry) — Tailwind CSS look-alike plugins (tailwind-lines-clamps, tailwind-lineclamp, tailwind-forms-kit, tailwind-custom-forms, tailwind-clamps-line, tailwind-form-styles, tailwindcss-contact-forms, tailwind-anim, tailwindcss-anim, scrollbar-hide-plugin)
    Vulnerable versions: all versions other than the 0.0.1-security placeholder
    Fixed in: 0.0.1-security placeholder
  • npm (registry) — cdeops, @adminide-stack/utils
    Vulnerable versions: malicious versions flagged by GitHub on 2026-11-04
  • Multi-platform — Developer workstations (Windows, macOS, Linux) running Node.js, VS Code, Chrome or Edge
    Vulnerable versions: all

Timeline

  • tailwind-lines-clamps first published on npm; it remained installable for months.
  • locked-ioc-11 registered (per JFrog).
  • First AccuraSoftHire job ad recorded.
  • Attacker Ethereum wallet sends its first transaction.
  • Look-alike packages published (e.g. tailwind-custom-forms 0.5.2 by goss1000); several published and removed through 2026-10-06.
  • Joint advisory (FBI, DC3, Japan, Australia, Germany) attributes fake-interview campaigns to North Korean actors with 30,000+ devices infected in 100+ countries.
  • Last C2 address posted via the Ethereum wallet (locked-ioc-13).
  • Binance theft of about $6.34B; Binance later says it began with a fake interview assignment and the FBI attributes it to North Korea. JFrog finds no AccuraSoftHire link.
  • Binance publishes initial findings; a fourth look-alike package is republished and removed within three hours.
  • GitHub flags malicious versions of @adminide-stack/utils and cdeops as malware.
  • JFrog publishes its AccuraSoftHire research.
  • StepSecurity publishes its analysis; locked-ioc-11 is on client hold and npm replaces the last two long-lived packages (Nov 12-13).

Sources cited

More from Contagious Interview

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats