# AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

> A fake-recruitment operation (AccuraSoftHire) gives developers a take-home React test whose Tailwind config loads a malicious look-alike npm plugin, then pushes a fake camera 'driver' and a 'job alerts' browser extension. The PolinRider-family loader resolves its C2 address from an Ethereum wallet (NullReceiver dead-drop) and downloads further Node.js stages; the method matches North Korea-linked Contagious Interview tradecraft, but JFrog found no link to the Binance October 29 intrusion.

- **Published:** 2026-11-13T17:17:21Z
- **Last reviewed:** 2026-11-13T17:17:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5981
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5981.png
- **ID:** TL-2026-5981
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Contagious Interview (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 34 (3 shown free below)

## Description

StepSecurity (2026-11-13) and JFrog Security Research (2026-11-09) document AccuraSoftHire, a fake company with a careers site (accurasofthire.com, registered 2026-04-17), job ads on Indeed, Glassdoor and LinkedIn, ID-verified recruiter profiles and a GitHub organization. Candidates complete two interviews and receive a take-home React landing-page repository. The project's Tailwind configuration loads a trojanized look-alike of a Tailwind plugin (e.g. tailwind-custom-forms, a copy of @tailwindcss/forms with a loader appended). The loader executes when Tailwind builds CSS, not at npm install, so no install script exists to flag. Ten look-alike packages published by the npm accounts goss1000, sun117, evaward1, georgeodom1 and helmets were identified; some (tailwind-lines-clamps, first published 2026-04-16, and tailwind-lineclamp) stayed installable for months. Malicious versions of cdeops and @adminide-stack/utils (OpenSSF MAL-2026-18643) were flagged by GitHub on 2026-11-04.

The careers site then stages a ClickFix-style social-engineering step: a camera-compatibility check fails after about six seconds without ever calling getUserMedia, and the /vscode-setup page builds a curl command per user agent that fetches CameraDriverUpdate.msi, CameraDriverUpdate-mac.zip or CameraDriverUpdate.deb from /camera-driver/setup-win|mac|linux. On Windows the bootstrap (/camera-driver/bootstrap-win?flag=10) installs Node.js if missing (%USERPROFILE%\.nvm\bootstrap.cmd), downloads /camera-driver/payload.js, runs it hidden, deletes it, calls /camera-driver/ack and deletes itself; macOS/Linux use the same flow in bash with nohup and delayed self-delete. A second path has the candidate load an unpacked 'job alerts' extension (extensions/job-new-alerts), run setup-full-windows.ps1 with execution policy bypassed, and register the native messaging host com.accurasoft.jobalerts for Chrome and Edge; the host runs curl piped to cmd against /notification-settings-win, and a scheduled task polls the site every five minutes. As of 2026-11-02 that bootstrap ran an empty node -e "" payload slot. A .vscode/tasks.json with runOn folderOpen is also an artifact to hunt.

The loader (PolinRider family, build markers A10-online, A10-npm-handy, A10-new_npm, A10-npm_inject; also sent in a Sec-V header) is obfuscated as a base64 string array passed to eval(atob(...)). It queries the Ethereum transaction history of sender 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a via eth.blockscout.com (other reporting names 1rpc.io/eth and eth.drpc.org), takes the newest transaction and decodes the C2 IP from the recipient address bytes (the 'NullReceiver' technique; the recipient also carries the ASCII string 'helloipbot!!'). It then fetches two stages over plain HTTP on port 443 from /0x/cls (run in-process) and /0x/ls (run as a detached Node process), XOR-decoded with hardcoded keys. StepSecurity reports the loader steals browser credentials, cryptocurrency wallet data, SSH keys, cloud credentials and git credentials, and uses stolen git credentials to inject the loader into other repositories while rewriting commits to preserve original dates. JFrog notes it did not analyze the stage payloads, so specific theft targets come from StepSecurity.

Attribution: the vector follows the North Korea-linked Contagious Interview playbook, and attribution rests on shared indicators with PolinRider and ClickFake (A10 markers, /0x/cls and /0x/ls paths, camera-check method). A joint advisory of 2026-09-18 (FBI, DC3, Japan, Australia, Germany) attributes fake-interview campaigns to North Korean actors with 30,000+ devices infected across 100+ countries. Binance, citing the FBI, attributes its 2026-10-29 theft (about $6.34B) to North Korea and says it began with a fake interview assignment; JFrog found no link between AccuraSoftHire and that intrusion.

## MITRE ATT&CK

- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1566.003 Spearphishing via Service
- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1053.005 Scheduled Task
- T1176.001 Browser Extensions
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1684.001 Impersonation
- T1555.003 Credentials from Web Browsers
- T1552.004 Private Keys
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**AccuraSoftHire — Look-alike Tailwind/npm Package Installed or Written to node_modules (PolinRider Loader)** (`TL-2026-5981-SPL-001`)

Detects the AccuraSoftHire take-home-test supply-chain vector (TL-2026-5981): a developer machine installing or materializing one of the malicious Tailwind look-alike npm packages (tailwind-custom-forms, tailwind-lines-clamps, tailwind-lineclamp, tailwind-forms-kit, tailwind-clamps-line, tailwind-form-styles, tailwindcss-contact-forms, tailwind-anim, tailwindcss-anim, scrollbar-hide-plugin) or the flagged cdeops / @adminide-stack/utils packages (MAL-2026-18643). The PolinRider-family loader runs when Tailwind builds CSS, not at npm install, so there is no install script to flag; the package name in a process command line or a node_modules file write is the earliest reliable signal. Matches on exact package-name boundaries to avoid hits on legitimate plugins such as tailwindcss-animate.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1204.002, T1059.007, T1656
- **Data sources:** sysmon, windows_process_creation, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h (EventCode=1 OR EventCode=11)
| eval artifact=coalesce(CommandLine, TargetFilename)
| where match(artifact, "(?i)(node_modules.| |^)(tailwind-custom-forms|tailwind-lines-clamps|tailwind-lineclamp|tailwind-forms-kit|tailwind-clamps-line|tailwind-form-styles|tailwindcss-contact-forms|tailwind-anim|tailwindcss-anim|scrollbar-hide-plugin|@adminide-stack.utils|cdeops)([^a-z0-9._-]|$)")
| eval evidence=if(EventCode=1, "package_in_process_commandline", "package_written_to_node_modules")
| stats count min(_time) as first_seen max(_time) as last_seen values(artifact) as artifacts values(ParentImage) as parent_images by host, User, Image, evidence
| convert ctime(first_seen) ctime(last_seen)
| table host User Image evidence count first_seen last_seen artifacts parent_images
```

### Microsoft KQL

```kql
let lookalikeRe = @"(?i)(node_modules.| |^)(tailwind-custom-forms|tailwind-lines-clamps|tailwind-lineclamp|tailwind-forms-kit|tailwind-clamps-line|tailwind-form-styles|tailwindcss-contact-forms|tailwind-anim|tailwindcss-anim|scrollbar-hide-plugin|@adminide-stack.utils|cdeops)([^a-z0-9._-]|$)";
union
    (DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine matches regex lookalikeRe
    | project Timestamp, DeviceName, Account = AccountName, Evidence = "package_in_process_commandline", Process = FileName, Artifact = ProcessCommandLine, Parent = InitiatingProcessFileName),
    (DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("FileCreated", "FileModified")
    | where FolderPath matches regex lookalikeRe
    | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Evidence = "package_written_to_node_modules", Process = InitiatingProcessFileName, Artifact = FolderPath, Parent = InitiatingProcessParentFileName)
| summarize Events = count(), First = min(Timestamp), Last = max(Timestamp), Artifacts = make_set(Artifact, 10) by DeviceName, Account, Process, Evidence
```

### Sigma

```yaml
title: AccuraSoftHire Look-alike Tailwind npm Package in Process Command Line
id: 7c1f3a52-8e41-4b6d-9a27-5d0c1e8f2a01
status: experimental
description: Detects npm/yarn/pnpm or node process command lines that reference the malicious Tailwind look-alike packages or cdeops / @adminide-stack/utils tied to the AccuraSoftHire fake-interview campaign (PolinRider-family loader, TL-2026-5981).
references:
    - https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines
    - https://research.jfrog.com/post/accurasofthire-fake-interview/
    - https://osv.dev/vulnerability/MAL-2026-18643
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1204.002
    - attack.t1059.007
    - attack.defense-evasion
    - attack.t1656
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|re: '(?i)(node_modules.| |^)(tailwind-custom-forms|tailwind-lines-clamps|tailwind-lineclamp|tailwind-forms-kit|tailwind-clamps-line|tailwind-form-styles|tailwindcss-contact-forms|tailwind-anim|tailwindcss-anim|scrollbar-hide-plugin|@adminide-stack.utils|cdeops)([^a-z0-9._-]|$)'
    condition: selection
falsepositives:
    - Security researchers or package-registry analysts pulling these packages in a sandbox
    - Vulnerability scanners that echo package names in command lines
level: high
```

**Known false positives:**

- Security researchers or registry analysts installing the packages in an isolated sandbox
- Software composition analysis or inventory tools that print package names in command lines

**Tuning notes:** Exclude known research/sandbox hosts by host or user. Extend the package list as JFrog/StepSecurity publish new look-alikes; the exact-name boundary match avoids hits on legitimate plugins such as tailwindcss-animate. Pair with lockfile review, since the loader fires at Tailwind build time rather than install time.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- AccuraSoftHire — ClickFix Fake Camera Driver Download and Install Chain (locked: unlock with TL Creds)
- AccuraSoftHire — Native Messaging Host, Scheduled Task and Unpacked Extension Persistence (locked: unlock with TL Creds)
- AccuraSoftHire — C2 and Stage Retrieval Connections to Wallet-Decoded IPs and Campaign Infrastructure (locked: unlock with TL Creds)
- AccuraSoftHire — Obfuscated eval(atob()) Node Loader and A10 Build Markers (locked: unlock with TL Creds)
- AccuraSoftHire — Bootstrap and Setup Script Execution ([indicator], .nvm bootstrap.cmd, curl to cmd) (locked: unlock with TL Creds)
- AccuraSoftHire — VS Code Workspace Task Auto-Run Spawning Shells That Fetch Remote Content (locked: unlock with TL Creds)
- AccuraSoftHire — Node.js Process Reading Browser, Wallet, SSH, Cloud and Git Credential Stores (locked: unlock with TL Creds)
- AccuraSoftHire — Node.js Dead-Drop Lookup to Ethereum Endpoints (NullReceiver C2 Resolution) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 34)

Defanged, TLP:CLEAR.

- IP address: `103.179.142[.]155`
- Domain: `accurasofthire[.]com`
- IP address: `23.27.13[.]72`

Full set of 34 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Take-Home Test That Runs on Your Work Laptop: Inside the AccuraSoftHire Fake Interview Campaign (StepSecurity)](https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines)
- [Contagious Interview: One Interview Away From Infection (JFrog Security Research)](https://research.jfrog.com/post/accurasofthire-fake-interview/)
- [29 October 2026 Binance Security Incident: Initial Findings and Response Update](https://www.binance.com/en/blog/community/3229153443759566763)
- [Binance's $6.3 billion hack began with a fake job (Axios)](https://axios.com/2026/11/03/north-korea-job-interview-binance-heist)
- [North Korean WaterPlum hackers infected 30,000 devices worldwide (BleepingComputer)](https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/)
- [NullReceiver: DPRK C2 technique (OpenSourceMalware)](https://opensourcemalware.com/blog/nullreceiver-dprk-c2-technique)
- [A Developer's Guide to Getting Rid of PolinRider (OpenSourceMalware)](https://opensourcemalware.com/blog/developer-guide-getting-over-polinrider)
- [OpenSSF malicious packages MAL-2026-18643 (@adminide-stack/utils)](https://osv.dev/vulnerability/MAL-2026-18643)
- [Attacker Ethereum wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a (Blockscout)](https://eth.blockscout.com/address/0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a)
- [PolinRider Loader Reappears in Hijacked npm Packages (Sonatype)](https://www.sonatype.com/blog/polinrider-loader-reappears-in-hijacked-npm-packages)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5981