LinkedIn fake recruiter and headhunter detector: spotting infiltration bots
Defending engineers and defense contractors from North Korean and state-sponsored recruiter malware campaigns.
Verify media authenticity with Sealed Rose
Free: 1 check a day, 8 with a free account · Deleted after your scan
State-sponsored threat actors (such as Lazarus Group) create thousands of fake LinkedIn recruiter profiles with AI-generated headshots. They reach out to software developers, defense contractors, and Web3 engineers with lucrative job offers, asking them to clone a GitHub repo or execute a coding challenge that installs remote access trojans (RATs).
Signs to look for
1AI headshot with perfectly centered eyes
Headshot aligns with the StyleGAN/Midjourney eye-centering rule: pupils sit at the exact horizontal midpoint of the image canvas.
2Urgent request to run a coding challenge on your local machine
They send a zip file or GitHub link containing obfuscated npm/pip dependencies with post-install malware scripts.
How to protect yourself and take action
Run recruiter headshot through Sealed Rose
Check for GAN/Diffusion face synthesis markers.
Never run unvetted candidate code on your bare metal
Always sandbox coding challenges in ephemeral cloud VMs or isolated containers.
The "contagious interview" malware attack
- Malicious dependency poisoning: The coding test includes a `package.json` with a malicious `preinstall` hook that exfiltrates browser cookies and SSH keys.
Frequently asked questions
Why are fake recruiters sending coding tests?
They use coding tests as a trojan horse to deliver malware directly onto developer laptops, stealing API keys, crypto wallets, and proprietary source code.
Have a file to check?
Scan a photo free →