Baarakɛcogo nkalonma ani yɔrɔjan ɲininkali nanbara: Kore Worodugu Lazarɛ BeaverTail npm Repo Malware, Minɛnw sɛgɛsɛgɛli nkalonmaw, ani Identity Lockdown¶

K’a dɔn yɔrɔjan baara ɲininkali walima onboarding taabolo cɛmancɛ la yɛrɛ ko "recruiter" walima "hiring manager" bɛ ka sibɛri walima wariko jaan sɛgɛsɛgɛlen dɔ boli, o ye kɔrɔtɔko ye min bɛ kɛ ɲɛfɛ fila ye. Bi yɔrɔjan baara nanbarako bɛ tila ka kɛ baara fila ye minnu bɛ tiɲɛniba kɛ, FBI, CISA ani diɲɛ ɛntɛrinɛti baaradaw ye minnu jira: (1) Software Developer ani Crypto "Coding Assessment" Malware (Contagious Interview / RPDC Lazarɛ kulu BeaverTail & . InvisibleFerret), yɔrɔ min na baarakɛlaw ɲininikɛla dɔ bɛ LinkedIn, Upwork, walima Telegram kan, o b’a ɲini porogaramu injiniyɛri dɔ fɛ walima Web3/AI kandida dɔ fɛ a ka GitHub, GitLab, walima Bitbucket marayɔrɔ dɔ clone ani ka baara kɛ npm install && npm start (walima Python/Docker jɔli dɔ) u ka ɔridinatɛri fɔlɔ kan walasa ka "bug dɔ labɛn ka kɔn interview ɲɛnama ɲɛ," ka kunnafoni-sonya-kɛla dɔ kɛ makun na min bɛ navigatɛri session cookie bɛɛ exfiltrate, password manager vault, .ssh kile, .env dosiye, ani kriptowari waribɔlan segin 5 jukɔrɔ; ani (2) Fake Check "Home Office Equipment" ani Reshipping Mule Scams, yɔrɔ min na, baarakɛda min bɛ a yɛrɛ kɛ i n’a fɔ a bɛ sms/Teams interview kɛ, o bɛ nkalon dɔ ci imɛri la $2,500 to $5,000 "MacBook Pro ani so biro sigicogo" lajɛ, ka cikan di i ma ko i ka sɛkɛsɛkɛli bila mobili kɔnɔ ani k'a ci $2,200 Zelle, Venmo, wire, walima kado kartiw fɛ ka taa u ka "IT minɛn feerela min dabɔra" sanni sɛki ka pan tile damadɔ kɔfɛ. Walasa ka SSN/I-9 identité sonya ani general check fraud onboarding, aw ye sɛbɛn ɲɛ baara dicogo nkalonma nanbara, minɛnw sɛgɛsɛgɛli nanbara, ani onboarding identité sonya; ni npm/PyPI pake kilisi jiginni ani navigatɛri kuki sonya, aw ye lajɛ supply chain npm/PyPI pake bɛnkan ani developpeur baarakɛyɔrɔ kilisi jiginni ani session cookie hijacking, infostealer malware, ani passkey bɔli. Ni aw bɛ ka farikolo fanga digi joona, ka bagabagali kɛ aw ma ka swat kɛ, walima ni aw yɛrɛ ye ciden ye, aw bɛ aw ka sigida ka kɔrɔtɔko nimɔrɔ wele (911 Ameriki ni Kanada jamanaw na, . 112 Erɔpu tɔnba kɔnɔ, . 999 in the United Kingdom) walima ka an ka gafe ɲɛbilasɛbɛn lajɛ kɔrɔtɔko nimɔrɔw.

Aw bɛ o kɛ sisan¶

1. NI I BOLOLI npm install, . npm test, . yarn, . pip install, walima Zoom/Teams/Miro nkalonma dɔ .dmg/ ..exe baara ɲininkali kama: AW KA AW KA Ɔridinatɛri TIGI WI-FI NI ETHERNET NA SECOND 3 KƆNƆ:
2. Aw bɛ Ethernet kabɔri sama walima ka Wi-Fi OFF da joona.
3. E BeaverTail JavaScript/Node.js payload bɛ Python sigida dɔ telesarse min bɛ se ka ta (-/.npl walima %UserProfile%\.pyp) ka laseli kɛ ** .InvisibleFerret** kɔfɛda, min bɛ tali kɛ cikan-ni-kɔlɔsili dɔ la (C2) baarakɛla ( ) .:1224 / . :1244) ka i ka tulonkɛfɛnw, i ka klipuw, ani i ka filesystem live.
4. Aw bɛ baara kɛ ni smartfon wɛrɛ ye min saniyalen don (iPhone walima Android selilɛri kunnafoniw kan) walasa ka kriptowari waribɔlanw bɛɛ bɔ kɛnɛ kan ani ka navigatɔrɔn ka lajɛ baarakɛlen bɛɛ bɔ yen (Google, . GitHub, . AWS, . Microsoft, . Apple):
5. BeaverTail laɲiniw MetaMask, Phantom, Rabby, Coinbase Portefeuille, Trust Portefeuille, Exodus, Electrum, ani Solana CLI (-/.config/solana/id.json) vault files, ka fara Login Data ani Cookies ka bɔ Chrome, Brave, Edge, Arc ani Firefox la, ka fara i ka macOS kan login.keychain-db.
6. Ka bɔ minɛn saniyalen na, kripto nafolo o nafolo bɛ waribɔlan funtenimanw kan, o bila ka taa waribɔlan kisɛ kura yɛrɛ la, ka ɛntɛrinɛti lajɛ baarakɛtaw bɛɛ bɔ Google kɔnɔ (myaccount.google.com/security), GitHub ( ) .github.com/settings/sessions), ani AWS/Cloud konsolɛw, ani k’i ka SSH ni GPG kilisi tiɲɛnenw bɔ GitHub/GitLab kɔnɔ.
7. NI I YE "HOME OFFICE EQUIPMENT" SƆRƆ DƆRƆBƆLI LA: I KAN'A DƆLƆRƆ KELEN CI "FƐƐRƐLA" SI MA, ANI KA I KA BANKI KA NAFOLO ƝƐNABƆLI WEELE YƆRƆBƆLI:
8. Hali ni i ka banki app b’a jira ko... $3,500 check as "Available Balance / Funds Released," ko wari TƐ jɛya. Ameriki Fɛdɛrali Reserve Sariyasen CC (Expedited Funds Availability Act), bankiw ka kan ka sɛkɛsɛkɛli bilali kɛ waati dɔɔnin kɔnɔ 1 to 2 business days, k' a sɔrɔ k' a ye ko sɛkɛsɛkɛli ka sira/konte nimɔrɔ ye nkalon ye , o bɛ ** ta .5 to 14 business days**.
9. Aw bɛ nimɔrɔ min bɛ aw ka debiti karti kɔfɛ, aw bɛ o wele ka kunnafoni di: "Baara sɛgɛsɛgɛli nanbara dɔ ye ne laɲini, wa ne ye sɛkɛsɛkɛli nkalonma dɔ bila, k'a sɔrɔ ne ma dɔn; aw ka wari bilalen taamasiyɛn kɛ walasa ne ka jatebɔsɛbɛn kana datugu nanbara kosɔn."
10. NI I YE ZELLE, VENMO, WIRE, WAALIMA BITCOIN ATM NAFOLO CI "MINƐNW FƐƐRƐLA" YE KABAN: Aw bɛ aw ka banki ka Fraud / Wire Recall tabali wele joona (ni aw ye filiw sɔrɔ, aw bɛ teliya ** ɲiniSWIFT / Fedwire Recall ani FBI IC3 ye Recovery Asset Team ka gilase**; Zelle/Faster Payments kama, aw bɛ Push Payment yamaruyalen (APP) baara kɛcogo misali nanbara jukɔrɔ yamaruyalen push payment app nanbara ani wari seginni hakɛw).
11. NI I YE I KA SSN, PASSEPORT, SUBOLI LISENS, W-4, I-9, ALIMA DEPOSIT DIRECT BANK ROUTING NUMBER CI: I ka credit freeze bila Equifax, Experian, ani TransUnion la, ka ChexSystems freeze, ka i ka SSN da myE-Verify (myeverify.uscis.gov), ani k’a ɲini i ka banki fɛ a ka jatebɔsɛbɛn nimɔrɔ min bɛ kɛnɛ kan, o datugu ani ka jatebɔsɛbɛn nimɔrɔ dɔ da wuli min bɛ se ka bila a nɔ na.
12. NI I SON "PACKAGE INSPECTION / LOGISTICS COORDINATOR" BAARA MIN BƐ SƆRƆ PARCELIW SƆRƆ ANI KA ƝƐNABƆLI SƆRƆ KA BƆ SO: AW KA PACKAGEW CI DƆN YƆRƆBƆLI: O ɛntɛrinɛti (iPhones, . MacBooks, . camera lenses) sanna ni karti sonyalenw ye ka ci i ka so ladɛrɛsi la (Parcel Mule Scam). Aw ye cikan sɛbɛnw ni baro sɛbɛnw bɛɛ mara ani ka kuma sigida polisiw fɛ walima US Postal Inspection Service (USPIS).

--- .

Desizɔn jiri : yɔrɔjan ɲininkali ani baara kɔrɔtɔko sɛgɛsɛgɛli nkalonma¶

Baara kɛ ni nin jatebɔsɛbɛn in ye walasa ka pan ka ɲɛsin containment protocol ma min bɛ bɛn baara namara suguya tigitigi ma i ye min sɔrɔ:

flowchart TD
    Start["Kɔrɔtɔko: Baara ɲininkali nkalonma min bɛ siga la, Coding Test, walima Onboarding Scam"] --> ScamType{"‘Mɔgɔ ɲininikɛla’ walima ‘Baarakɛla’ ye mun ɲini i fɛ?"}

    ScamType -->|"1. Git Repo dɔ clone & Run npm / Python / Docker OR ka Wideyo weleli App custom dɔ sigi"| DevTrap["KƆRƆBƆLI: DPRK ka ɲininkali banakisɛfagalanw (BeaverTail / InvisibleFerret) Info-Stealer"]

    ScamType -->|"2. Aw bɛ Sɛki (PDF/Mail) bila & ka wari ci ‘Mɛn feerela dɔ ma min dagalen don’."| CheckTrap["Fake Check Overpayment Scam: Check Provisional Credited bɛna Bounce Tile 5-14 kɔnɔ"]

    ScamType -->|"3. I-9 / W-4 / SSN / Pasipɔri / Direct Deposit sɛbɛn dafa Sani i ka nanbarako sɔrɔ"| IdTrap["Onboarding Identity & Payroll Sonya: Kredi Freeze, ChexSystems, IRS IP PIN, & Banki ka jatebɔsɛbɛn"]

    ScamType -->|"4. Ka Pakew sɔrɔ So kɔnɔ, k’u sɛgɛsɛgɛ, & ka segin ka ci ni sɛbɛnw ye minnu dira OR Pay ‘Task’ Crypto"| MuleOrTask["Parcelle Mule OR 'App Optimisation' Crypto Baara nanbarako seginni"]

    DevTrap --> CutNet["1. Wi-Fi OFF / Ethernet bɔ a la o yɔrɔnin bɛɛ Developer Workstation kan"]
    CutNet --> EvacPhone["2. Telefɔni saniyalen kan: Crypto Assets Lamaga + Google/GitHub/AWS Sessions Labɔ + SSH Keys Lamaga"]
    EvacPhone -->ForensicClean["3. Aw ye -/.npl, -/.pyp, package.json, & Browser Profiles sɛgɛsɛgɛ -> OS ko ani ka a sigi kokura ka saniya"]

    CheckTrap --> SentMoney{"Yala I ye Wari Ci ‘Mɛnfeerekɛla’ ma kaban wa?"}
    SentMoney -->|"Ayi: Check Deposited, $0 Cilen bɔra"| WarnBank["AW KAN’a maga Nafolo la -> Aw bɛ Banki Namara Dept wele o yɔrɔnin bɛɛ walasa ka Flag Unknowing Bad Check Deposit"]
    SentMoney -->|"Ɔwɔ: A bɛ ci Zelle / Wire / Crypto / Kado Kartiw fɛ"| RecallFunds["Aw bɛ Banki Wire/Fraud Desk wele o yɔrɔnin bɛɛ -> Aw ye Overdraft Negatif datugu Sani aw ka Bounces lajɛ -> File IC3 Report"]

    IdTrap --> LockCredit["Freeze Equifax/Experian/TransUnion + ChexSystems -> Banki jatebɔsɛbɛn nimɔrɔ min bɛ kɛnɛ kan, o datugu -> Lock myE-Verify"]
    MuleOrTask --> StopShip["Pakew cili dabila & Crypto bilali dabila -> Waybills mara & ka kunnafoni di USPIS / IC3 ma"]

--- .

Dakun fɔlɔ : Yɔrɔjan-baara-jaanba fila bɛ baara kɛ cogo min na hood jukɔrɔ¶

Baarakɛcogo kɔrɔtɔko fɔlɔ saba minnu bɛ baara la diɲɛ kɔnɔ, olu ka fɛɛrɛbɔ mekanikiw ni darapo bilenman jiralanw suma ɲɔgɔn na:

--- .

Dakun 2nan : Kɔrɔtɔko jaabi porogaramuw dilannikɛlaw ye (Contagious Interview / . BeaverTail / . InvisibleFerret) .¶

N’i ye porogaramuw dilabaga ye min ye fɛnmarayɔrɔ dɔ clone ka bɔ mɔgɔ ɲininikɛla walima ɲininkalikɛla dɔ fɛ ka boli npm install, . npm start, . yarn, . pnpm, . python, . cargo, walima executable min bɛ i ka Windows, macOS, walima Linux baarakɛyɔrɔ kan, i ka tugu nin ko kɛlen jaabi tigitigi in kɔ min sinsinnen bɛ Palo Alto Networks Unit 42, CrowdStrike, ani CISA/FBI bagabagali kunnafoniw kan Kore Worodugu kan Contagious Interview kanpaɲi.

Taabolo fɔlɔ: Aw ye 2-Stage faamuya BeaverTail -> InvisibleFerret Kill Chain bɛ i ka disiki kan¶

React/Node.js marayɔrɔ min bɛ iko a bɛnnen don, o ye i ka Mac walima PC minɛ cogo di k’a sɔrɔ a ma antivirus popup dɔ daminɛ?

+-------------------------------------------------------------------------+
| ANATOMY OF A CONTAGIOUS INTERVIEW (BEAVERTAIL) MALICIOUS REPO           |
|                                                                         |
| 1. The Decoy Repo (e.g., "mern-ecommerce-assessment" or "defi-dex-ui"): |
|    - 99% of the repo is real, working React/Express boilerplate code.   |
|    - Hidden at the very end of `server/routes/api/auth.js` or           |
|      `backend/controllers/userController.js` (often scrolled 300 spaces |
|      to the right on one line so you do not see it in VS Code) is an    |
|      obfuscated `eval(Buffer.from(...))` or `axios.get(...)` call.      |
|                                                                         |
| 2. Stage 1: BeaverTail (JavaScript Info-Stealer inside Node.js):        |
|    - Scans Chrome, Brave, Opera, Edge, Vivaldi (`Default` & `Profile N`)|
|      for `Login Data`, `Local Extension Settings` (MetaMask `nkbihfbeog`|
|      Phantom `bfnaelmome`, Rabby `acmacodkjb`), and Solana `id.json`.   |
|    - Uploads stolen vaults & cookies immediately to `http://<C2>:1224`. |
|                                                                         |
| 3. Stage 2: InvisibleFerret (Python Backdoor + AnyDesk Persistence):    |
|    - BeaverTail downloads a standalone portable Python 3.11 zip into    |
|      `~/.npl/` or `%UserProfile%\.pyp\` and runs `~/.npl/.pyp/python`   |
|      executing `~/.npl/main.py` (`InvisibleFerret`).                    |
|    - InvisibleFerret logs keystrokes, reads your clipboard, scans your  |
|      entire drive for `.env`, `.ssh`, `seed`, `mnemonic`, and silently  |
|      downloads/configures `AnyDesk` for full remote desktop control.    |
+-------------------------------------------------------------------------+

Taabolo 2nan: Aw bɛ a lajɛ ni a tigitigi don BeaverTail ani InvisibleFerret Bɛnkansɛbɛnw jiralanw (IoCs) .¶

K’a sɔrɔ i ka Mac, Linux walima Windows ɔridinatɛri min bananen don, o tigɛra pewu Wi-Fi ni Ethernet la, i ka terminal (walima PowerShell) da wuli walasa k’a lajɛ ni Stage 2 (InvisibleFerret) binna i ka disiki kan :

# On macOS or Linux (WITH WI-FI OFF):
ls -la ~/.npl ~/.pyp ~/.vscode
ps aux | grep -iE "npl|pyp|main\.py|anydesk|node"

# Search the cloned interview repository for hidden horizontal-scroll obfuscation or base64 evals:
grep -rnE "Buffer\.from|child_process|execSync|\.npl|\.pyp|:1224|:1244|nkbihfbeogaeaoehlefnkodbefgpgknn" /path/to/cloned/interview_repo/

# On Windows PowerShell (WITH WI-FI / ETHERNET OFF):
Get-ChildItem -Path $env:USERPROFILE -Force | Where-Object { $_.Name -match "^\.(npl|pyp)" }
Get-Process | Where-Object { $_.Path -match "npl|pyp|AnyDesk" }

3nan : Ka miniti 15 Developer Credential & Crypto Evacuation (Ka bɔ minɛn saniyalen dɔ la) kɛ .¶

Aw kana aw kana tɔgɔlasɛbɛn kura walima kisɛ kumasen kura sɛbɛn ɔridinatɛri banakisɛ bɛ min na. Baara kɛ ni smartphone saniyalen ye (iPhone / Android) walima ɔridinatɛri danfaralen min tɛ fɛn tiɲɛ:

1. Aw bɛ Cryptocurrency Hot Wallets bɛɛ bɔ yen joona (Minutes 0 to 5):
2. Hali n’i ka MetaMask, Phantom, Rabby walima Exodus waribɔlan tun datugulen don ni tɔgɔlasɛbɛn ye, BeaverTail a ye i ka vault file encrypté bila (000003.log / . LOCK / . Local Extension Settings) ani . InvisibleFerret a bɛ keylogger/clipboard monitor dɔ baara (ani macOS kan, a bɛ native nkalonma dɔ bɔ kɛnɛ kan osascript password dialog min b’a ɲini i ka Mac System Password fɛ a ka da wuli login.keychain-db).
3. Aw ye waribɔlan kura da aw ka telefɔni hakilitigi walima fɛnɲɛnamafagalan waribɔlan (Ledger / Trezor) kan ni daɲɛ 12/24 kisɛ kumasen kura ye ani ka aw ka tokenw, NFTw, ani staking jɔyɔrɔw kɛmɛsarada la 100 bɔ waribɔlan bɛɛ la min magara o ɔridinatɛri la.
4. Ka GitHub, GitLab, Bitbucket ani Cloud (AWS / GCP / Azure / Vercel) seereyaw ( ) .Minutes 5 to 10):
5. GitHub: Don i ka telefɔni na -> Settings -> SSH ani GPG keys -> Delete SSH key bɛɛ min tun maralen bɛ -/.ssh/ ɔridinatɛri min bananen don, o kan. O kɔ fɛ, taa Settings -> Developer settings -> Personal access tokens (ka token bɛɛ bɔ) ani Settings -> Sessions -> Revoke all sessions.
6. AWS / GCP / Cloud: O yɔrɔnin bɛɛ la, a bɛ se ka kɛ AWS_ACCESS_KEY_ID maralen bɛ san kɔnɔ -/.aws/credentials walima kɔnɔna dɔ .env dosiye min bɛ o ɔridinatɛri kan (InvisibleFerret recursively crawls poroze foli bɛɛ i ka drive kan for .env, . .npmrc, . .pypirc, . kubeconfig, ani id_rsa).
7. Ni Patɔrɔn walima Client ka fɛnmarayɔrɔw/kilisiw tun b’i bolo o ɔridinatɛri kan: I ka patɔrɔn ka Lakanali Baarakɛyɔrɔ ladɔnniya (SOC / . CISO) o yɔrɔnin bɛɛ walasa u ka se ka ɲɔgɔn falen-falen tɔnba .env gundo ni jatebɔ jɛkuluw.
8. Ka Browser Sessions bɛɛ bɔ yen (Google, . Microsoft, . Apple, . Slack, . Discord, . Telegram) ( ) ( ) .Minutes 10 to 15):
9. Aw hakili to a la: ni i ye tɔgɔlasɛbɛn Changer tuma caman na, o tɛ** session cookies sonyalenw tiɲɛ fo n’i ye "Bɔ ka bɔ minɛnw bɛɛ la / Revoke all sessions" digi k’a jɛya Google Security, Microsoft Account, Slack, Discord ani X/Twitter kɔnɔ.
10. Yɛlɛma don i ka Password Manager (1Password, . Bitwarden, . Keeper) master password ani ka ɔridinatɛri banakisɛ in ka minɛn token yamaruyalen bɔ yen.
11. Aw bɛ Operasɔn Sistɛmu ko ani k’a sigi kokura Baarakɛyɔrɔ min bananen don: Sabula InvisibleFerret a bɛ kɔkanna baara basigilenw sigi sen kan, ka navigatɔrɔn binariw sɛmɛntiya, ka jigin AnyDesk yɔrɔjan sɔrɔli, a bɔli dɔrɔn -/.npl ani fɛnmarayɔrɔ min kɛra clone ye, o tɛ se ka kɛ. Back up dɔrɔn sɛbɛn gansanw/sɔrɔyɔrɔ files (sɛgɛsɛgɛli saniyalen ni git status / . git diff), o kɔfɛ, OS saniyalen dafalen bɔli kɛ ka segin a kan (macOS Erase All Content and Settings walima Windows USB saniyalen partition wipe).

--- .

Fasokan2009-09_enterneti_kalanni.dis.html,#5413333 3nan : Kɔrɔtɔko jaabi "So biro minɛnw" sɛgɛsɛgɛli nanbarako nkalonmaw kan¶

Ni yɔrɔjan baara dɔ dira i ma (Administrative Assistant, . Data Entry, . Customer Support, . Project Coordinator, . Graphic Designer), ye sɛkɛsɛkɛli sɔrɔ (imeyi PDF fɛ walasa ka sɛbɛnni kɛ ani ka mobili-deposit kɛ, walima FedEx/UPS sufɛ anwɛlɛki fɛ) walasa ka ɔridinatɛri ni so biro minɛnw san, k’a bila i ka banki jatebɔsɛbɛn kɔnɔ, i bɛ boli la Federal Reserve check clearing return window fɛ.

1. Mun na banki app b'a fɔ ko "Funds Available" 100% fake check kan (The Regulation CC Float Trap) .¶

+-------------------------------------------------------------------------+
| HOW THE FAKE "EQUIPMENT CHECK" FLOAT TRAP WORKS                         |
|                                                                         |
| Day 1 (Monday): You deposit the scammer's $3,500 "Equipment Check"      |
|                 using your bank's Mobile Deposit app.                   |
| Day 2 (Tuesday): Under US Federal Law (Regulation CC), your bank MUST   |
|                  release the funds within 1-2 business days. Your app   |
|                  now shows: "Available Balance: +$3,500.00".            |
| Day 2 (Tuesday PM): "Hiring Manager" tells you to Zelle/Wire $2,800     |
|                     immediately to their "Approved MacBook Vendor" so   |
|                     your laptop arrives by Friday.                      |
| Day 8 (Next Tuesday): The real corporate bank whose routing/account     |
|                       number was forged on the check rejects it as      |
|                       COUNTERFEIT / ALTERED (`Return Code R29 / Refer   |
|                       to Maker`).                                       |
| RESULT ON DAY 8:                                                        |
|   - Your bank claws back the full $3,500.00 from your balance.          |
|   - The $2,800 you sent via Zelle/Wire is gone forever.                 |
|   - Your account drops to -$2,800.00 overdraft, and your bank's risk    |
|     algorithm may freeze/close your account and report you to           |
|     ChexSystems as a check-fraud risk.                                  |
+-------------------------------------------------------------------------+

2. Banki lakanani protocole senfɛ-senfɛ ni i ye sɛkɛsɛkɛli bila¶

Ko A: I ye sɛkɛsɛkɛli bila, nka i ma wari ci "feerekɛla" ma fɔlɔ¶

I ye bɔnɛ sɔrɔ $0 fo ka na se bi ma, wa i bɛ se k'i ka banki bali ka i ka jatebɔsɛbɛn datugu n'i ye wale kɛ sisan yɛrɛ: 1. Aw kana sɛkɛsɛkɛli wari bilalen santimɛtɛrɛ kelen bɔ, k’a musaka kɛ, walima k’a bila yɔrɔ wɛrɛ la. Aw bɛ a dafalen to yen $3,500 sigilen ma maga a la jatebɔsɛbɛn kɔnɔ walasa ni sɛkɛsɛkɛli bɛ wuli baarakɛdon 5 fo 10 kɔnɔ, banki bɛ a yɛrɛ ka waatilatigɛ juru segin a ma saniya ni $0 ka tɛmɛn a kan. 2. I ka banki ka nanbarako ɲɛmɔgɔso wele joona (walima i ka taama ka don bolofara farikoloma dɔ kɔnɔ ka kuma bolofara ɲɛmɔgɔ dɔ fɛ): - Ni sɛkɛsɛkɛli nkalonma dɔ bɛ panpan a makuntɔ k’a sɔrɔ ɲɛfɔli ma kɛ, banki otomatiki farati motɛriw (Early Warning Services / . ChexSystems) tɛ ​​se k’a dɔn n’i tun ye nanbarakɛla ye walima n’i tun ye baara ɲinibaga jalakibali ye. - A fɔ banki lasigiden ye ka jɛya ko: "Ne ye yɔrɔjan baara ɲini ani nanbarakɛla ye minɛnw sɛkɛsɛkɛli '$3500' ci n ma, n ye min bila mobili kɔnɔ bi. Ne y'a faamuya dɔrɔn ko baara sɛgɛsɛgɛli nanbarako nkalonma don. Ne ma dɔrɔmɛ kelen musaka kɛ walima k'a bila o wari la. N b'a ɲini ka Victim of Employment Scam sɛbɛn bila n ka profil kan ani ka waati kuntaala surun juru kɔsegin/ka walasa n ka jatebɔsɛbɛn kana jalaki ni sɛgɛsɛgɛli kɛra bɛ segin a ma sara." - A ɲini banki fɛ a ka ban $15 to $35 Returned Deposited Item fee ani k’a jira ko i ka jatebɔsɛbɛn tɛna taamasiyɛn kɛ walasa ka da tugu.

Ko B: I ye sɛkɛsɛkɛli bila ANI wari ci kaban (Zelle, . Venmo, . Wire, . Cash App, . Crypto, walima Gift Cards) .¶

1. Aw ye aw ka banki ka nanbarako ɲɛmɔgɔso wele segin 60 kɔnɔ:
2. Aw ye kojuguba in fan fila bɛɛ fɔ : (a) sɛkɛsɛkɛli min bɛ don, o ye baarakɛyɔrɔ nanbarako sɛgɛsɛgɛli nkalonma ye min bɛna wuli, ani (b) Zelle / Venmo / Wire / ACH jiginni min bɔra, o kɛra baara nanbara de sababu ye.
3. Ni i ye Banki Wire (Fedwire / SWIFT) sanga 24 fo 72 labanw kɔnɔ: A ɲini teliya la Fraudulent Wire Recall (SWIFT MT192 / pacs.004) ani ka kɔrɔtɔko kunnafoni di ** .ic3.gov** o la FBI ka Nafolo seginni jɛkulu (RAT) bɛ se ka Nafolo Namara faga Cakɛda (FFKC) freeze kan sɔrɔbaga mule jatebɔsɛbɛn kan.
4. Ni i ye ci bila Zelle, . Venmo, walima Angletɛri Faster Payments: Aw ye Push Sarali yamaruyalen (APP) nanbarako fɔli ani ka banki sɔrɔbaga ka sira/baarakɛyɔrɔ kunnafoniw ɲini (Zelle Network Fraud).
5. Ni nanbarakɛla y’a fɔ i ye ko i ka Apple, Razer Gold, Steam, walima Target Gift Cards san: I ka kado karti dibaga ka nanbara sira wele o yɔrɔnin bɛɛ ni resipi seriyali nimɔrɔw ye walasa ka karti balansi min ma kunmabɔ, o bɛɛ bila jɔ.
6. Aw ka aw labɛn ka... $3,500 check clawback walasa i ka jatebɔsɛbɛn kana taa negative ChexSystems charge-off kɔnɔ:
7. Ni fake $3,500 check bounces tile 5 fo 10 kɔnɔ, i ka banki bɛna dɔ bɔ $3,500 ka bɔ i ka jatebɔsɛbɛn kɔnɔ. Aw ye baara kɛ ni aw ka banki ka nanbarako ɲɛnabɔli jɛkulu ye walasa ka tɔnɔ zeru sarali bolodalen dɔ sigi sen kan balansi jugu o tɔnɔ jugumanba la ka kɔn tile 30 ɲɛ walasa banki kana jatebɔsɛbɛn datugulen kofɔ ChexSystems walima Ladilikan joona baarakɛlaw ye (EWS).

--- .

Dakun 4nan: Ka i ka danyɔrɔ datugu ni i ye sɛbɛn dɔ ci I-9, . W-4, . SSN, Pasipɔri, walima Direct Deposit sɛbɛn¶

A bɛ se ka fɔ ko mɔgɔ nkalontigɛlaw bɛ "Onboarding Packet" ci tuma bɛɛ (Form W-4, . Form I-9, . Direct Deposit Authorization, ani i ka bolifɛntigiyasɛbɛn, i ka Pasipɔri walima i ka Lakanali Sosiali karti ɲɛfɛla ni kɔfɛ fotow) sanni i ka sɛkɛsɛkɛli walima porogaramu juguw jaan bɔ. N’i y’o sɛbɛnw dɔ ci, i ka nin 5-step identity lockdown in kɛ bi:

1. Aw ka banki jatebɔsɛbɛn nimɔrɔ min jiralen don (Direct Deposit formulaire): Direct Deposit sɛbɛn dɔ bɛ i ka Bank Routing Number ( ) di nanbarakɛla ma.ABA) ani Checking Account Number dafalen, ka fara sɛki min ma tiɲɛ, n’i bolonɔ bilalen don, o ye fɛn bɛɛ ye min ka kan ka kɛ walasa ka papiye sɛgɛsɛgɛli nanbaratɔw bɔ walima ka daminɛ ni yamaruya tɛ ACH Debit sama ka bɔ i ka jatebɔsɛbɛn kɔnɔ. A fɔ i ka banki ye ko a ka o jatebɔsɛbɛn nimɔrɔ datugu ani k’i ka nafolo bila kɔnɔna jatebɔsɛbɛn kura la.
2. Aw ka Credit Freeze bila fu la crédit biro saba bɛɛ la:
3. **Equifax ** (equifax.com/personal/credit-report-services/credit-freeze/ / . 1-888-298-0045) .
4. Kɔrɔsilikɛla (experian.com/freeze/ / . 1-888-397-3742) .
5. TransUnion (transunion.com/credit-freeze / . 1-800-916-8800) .
6. Freeze (Freeze) ye ChexSystems (chexsystems.com) ani NCTUE: Bankiw bɛ baara kɛ ni ChexSystems ye (a tɛ Equifax/Experian ye) ni mɔgɔ dɔ ye jatebɔsɛbɛn da wuli i tɔgɔ la. Aw bɛ ChexSystems Security Freeze bila fu ɛntɛrinɛti kan walasa nanbarakɛlaw kana se ka mule banki jatew da wuli ni aw ka bolifɛntigiyasɛbɛn sonyalen ye ani I-9 pake.
7. I ka Lakanali Sosiali Nimɔrɔ datugu myE-Verify (USCIS): Taga ** .myeverify.uscis.gov** ani ka baara kɛ ** .Self Lock**, min bɛ mɔgɔ o mɔgɔ bali ka baara kɛ n’i ka SSN ye fédéral E-Verify baarakɛcogo la.
8. Aw ka IRS Identity Protection PIN (IP PIN) (irs.gov/ippin): Aw ye nanbarakɛlaw bali ka impositi seginni sɛbɛn nanbara kɛ aw tɔgɔ la, aw kɛtɔ ka aw tɔgɔ sɛbɛn IRS IP PIN nimɔrɔ 6 kɔnɔ o yɔrɔnin bɛɛ.

--- .

Fasa 5nan: "Parcel Reshipping Mule" walima "Crypto Task" Scam jɔli lafiya la¶

Ni i tun bɛ baara la nin yɔrɔjan baara nanbarako fila dɔ la kelen na do?

Ɲɛjirali 1nan : I sɔnna "Quality Control / Package Forwarding" baara la ani pakew bɛ i ka so¶

Ni i ye MacBook, iPhone, walima ɛntɛrinɛti sɔrɔ i ka so ladɛrɛsi la ani ni USPS/UPS/FedEx PDF cikan sɛbɛnw dira i ma minnu saralen don ka kɔn walasa k’u ci: - Aw ka pakew cili dabila joona. Foroko bɛɛ min bɛ se i ka so, o sanna ni karti sonyalen ye, nanbarakɛla ye i tɔgɔ ni i ka so ladɛrɛsi sɛbɛn yɔrɔ min na i n’a fɔ... Ship To ladɛrɛsi. - Aw kana pakew segin nanbarakɛla ka ladɛrɛsi la: Aw ye kɛsu da wulibaliw mara, ka imɛri, Telegramu baro, PDF cikan sɛbɛn, ani baarakɛsɛbɛn bɛɛ mara i n’a fɔ dalilu, ani ka kuma sigida polisiw fɛ ani U.S. Poste Sɛgɛsɛgɛli Baarakɛyɔrɔ (1-877-876-2455 / . uspis.gov) (walima Action Fraud Angletɛri jamana na) walasa ka jagofɛnw seginni labɛn ka di feerekɛlaw nanbaralenw ma.

Ɲɛjirali 2nan : I minɛna WhatsApp/Telegram fɛ "App Optimization / Product Rating" Crypto Task Job kama¶

• Jaan bɛ baara kɛ cogo min na: "Baarakɛla" bɛ i sara $50 to $150 tiɲɛ yɛrɛ la USDT tile fɔlɔ la butɔni digilen kan ɛntɛrinɛti dakun nkalonma dɔ kɔnɔ. Tile 2nan walima Tile 3nan na, i ka jatebɔ bɛ "Combination Task" dɔ gosi min b'i ka portal balansi bila -$400 ani a b’a ɲini aw fɛ aw ka wari bila $400 aw yɛrɛ ta ye USDT ka "baara 40 kulu dafa." I bɛ wari bila waati min na $400, baara filanan b' a ɲini $1,800, o de kosɔn $6,000, o de kosɔn $25,000 ka ɲɛsin "takisi" ma.
• Teliya wale: AW KA kriptowari bilali dabila joona. Jateden minnu bɛ baarakɛyɔrɔ in kan, olu ye HTML nafa nkalonmaw ye minnu bɛ mara nanbarakɛla fɛ; balansi jugu sarali tɛna bɔli da wuli abada. Aw ye ɲɔgɔnye bɛɛ tigɛ ani ka aw yɛrɛ tanga "crypto recovery hackers" ma Telegram walima Instagram kan.

--- .

Sigidaw ka kɔrɔtɔko nimɔrɔw ani baaradaw ka sariyaw¶

Yɔrɔjan interview malware (Contagious Interview), baara sɛgɛsɛgɛli nanbarako, ani onboarding identity sonya ka ɲɛsin ɛntɛrinɛti ni wariko ɲɛmɔgɔ ofisiyali ma aw ka mara kɔnɔ:

• Amerika ni Kanada: Dial 911 farikolo lakanani kɔrɔtɔko o kɔrɔtɔko la. Laseli kɛ developpeur malware (Lazarus / BeaverTail) ani baara sɛgɛsɛgɛli/baara bɔnɛ nkalontigɛlenw ka FBI IC3 (ic3.gov), o ye FTC (ReportFraud.ftc.gov ani IdentityTheft.gov), ani USPIS (1-877-876-2455). Kanada jamana na, aw bɛ se ka kuma Canada ka nanbara kɛlɛli baarada fɛ (1-888-495-8501) ani Kanada ka sibɛri lakanani baarada (1-833-CYBER-88).
• Royaume-Uni: Dial 999 ka ɲɛsin kɔrɔtɔko ma walima ** .101** sigida polisiw ye. Dial ** .159** ka jɛɲɔgɔnya kɛ ni i ka banki ka nanbarako ɲɛmɔgɔso ye, ani ka baarakɛlaw ka nanbara nkalontigɛlenw ni baarakɛlaw ka porogaramu juguw fɔ Action Fraud (0300 123 2040 / . actionfraud.police.uk) ani NCSC (ncsc.gov.uk). Aw ye jateminɛ kɛ CIFAS ka lakanani sɛbɛn (cifas.org.uk).
• Erɔpu jamanaw ka tɔnba: Dial 112 UE jamanaw bɛɛ kɔnɔ, aw ka aw ka banki ka nanbarako ɲɛmɔgɔso ladɔnniya joona, ka kunnafoni di aw ka jamana polisiw ka ɛntɛrinɛti juguya jɛkulu ma ani jamana ka CSIRT ma.
• Ɔsitarali ni Zelande kura: Dial 000 Ɔsitarali jamana na walima 111 Nuwɛlika jamana na. Baara ni baarakɛcogo nanbarako fɔ Scamwatch (scamwatch.gov.au), LaseliCyber ​​(cyber.gov.au, . 1300 CYBER1), ani ka kuma IDCARE (1800 595 160 ka AU / . 0800 121 068 ka NZ).
• Endi ni Azi Pasifiki: Dial 112 Ɛndujamana na kɔrɔtɔko la ani ka Jamana ka Sibɛri Juguya Dɛmɛnsira wele (1930 / . cybercrime.gov.in) o yɔrɔnin bɛɛ ka banki wari bilali nanbaratɔw jɔ. Singapuri jamana na, aw bɛ Anti-Scam Helpline wele (1799).

--- .

Ɲininkali minnu bɛ kɛ tuma caman na¶

N ye recruteur ka GitHub marayɔrɔ clone (git clone ...), ye dosiyew da wuli VS Code kɔnɔ walasa k’u kalan, wa a ma boli abada npm install walima npm start. Yala bana in bɛ ne la hali bi wa?¶

A tɛ i n’a fɔ `npm install` (min bɛ boli `package.json` scripts), bolicogo jɛlen `git clone` ani kalanjɛ jɛlen `.js` files tɛ kode kɛ a yɛrɛ ma FƆ NI fɛn jugu dɔ tun bɛ o marayɔrɔ la `.vscode/tasks.json` file ni `"runOn": "folderOpen"` ANI i ye "Ɔwɔ, n dalen bɛ sɛbɛnnikɛlaw la" digi tuma min na VS Code ye foli da wuli. Aw ye a lajɛ ni a `.vscode/tasks.json` dosiye bɛ yen repo clone kɔnɔ (`cat /path/to/repo/.vscode/tasks.json`) ani ka a lajɛ ni `-/.npl` walima `-/.pyp` dabɔra i ka so ɲɛbilasɛbɛn kɔnɔ. Ni u fila si tɛ yen ani ni i ma boli abada `npm`, . `yarn`, . `python`, walima `node`, i ka sitɛmu ma payload (nafa) kɛ : i ka foli clon (klon) bɔ dɔrɔn.

Ni n ye interview coding test boli Docker minɛn kɔnɔ dun (docker compose up) n ka Mac walima Windows PC kan wa? Yala o minɛn ye ne tanga wa?¶

A bɛ bɔ volume minnu tun bɛ don a kɔnɔ `docker-compose.yml` walima a `Dockerfile`. N’i ​​ye minɛn in boli ni filesystem kelen ye, o porogaramu jugu ma se k’i ka jatigila Chrome cookies walima MetaMask extension ye. Nka, mɔgɔ caman `Contagious Interview` marayɔrɔw la, a `docker-compose.yml` min bɛ gundo la bind-mount i ka jatigila so ɲɛbilasɛbɛn (`volumes: - -/.ssh:/root/.ssh` walima `- -/:/host_home`) walima a bɛ boli ni `privileged: true`. Sɛgɛsɛgɛli kɛ `docker-compose.yml` repo kɔnɔ o yɔrɔnin bɛɛ : ni a wulila `-`, . `$HOME`, walima `/Users`, i ka jatigila ɔridinatɛri minɛ i n' a fɔ a tiɲɛna .

Cogo di, sɛkɛsɛkɛli bɛ se ka kɛ nkalon ye ni "Cashier's Check" ye min bɛ lase FedEx Overnight fɛ ni ji taamasiyɛn ye ani banki warimarala sɔnna o ma jagokɛyɔrɔ la?¶

Kasɛri ka sɛkɛsɛkɛli nkalonmaw bɛ sɛbɛn kemikɛli sɛgɛsɛgɛli stock lakikaw kan ni sira nimɔrɔ bɛnnen ye ani magɛnni `MICR` banki belebele dɔ ka enki sɛbɛnnibolo. Hadamaden banki warimarala min bɛ tɔnbolofara dɔ ka finɛtiri la, o bɛ a sɛgɛsɛgɛ dɔrɔn ko sira nimɔrɔ bɛ se ka kɛ ani ko sɛki bɛ i n’a fɔ a ye tiɲɛ ye farikolo ta fan fɛ; warimarala tɛ se ka banki wɛrɛ kɔnɔna gafe kɔnɔ ye walasa k’a dɔn ni o sɛki seriyali nimɔrɔ bɔra tiɲɛ na. Ni sɛkɛsɛkɛli ja bɛ tɛmɛ Fɛderasiyɔn ka nafolosɔrɔyɔrɔ fɛ dɔrɔn (`5 to 10 business days later`) yala banki min bɛ wari bɔ , o bɛ ban a la k' a fɔ ko a ye nkalon ye .

Yala ne bɛ se ka taa kaso la ni ne ye baara sɛkɛsɛkɛli nkalonma dɔ bila a kɔnɔ k’a sɔrɔ ne ma a dɔn, ka wari dɔ musaka sanni a ka wuli wa?¶

Ka lafili baara sɛgɛsɛgɛli nanbarako dɔ fɛ, o tɛ kojugu kɛ (`mens rea`), n’a y’a sɔrɔ i ma nkalon tigɛ banki la ani ka nanbarako fɔ banki ka nanbarako ɲɛmɔgɔso ni polisiw ye (`IC3` / sigida polisiw ka kunnafoni) teliya la. Nka, i ka banki ka Deposit Account Agreement ani **Uniform Commercial Code (`UCC § 4-207 / § 4-214`)**, jatebɔsɛbɛntigi min bɛ sɛkɛsɛkɛli dɔ sinsin ani k’a bila, o ka kan ka banki sara siwili ni bɛnkansɛbɛn kɔnɔ, a ka wari saralen jugumanba kɛmɛsarada la, ni sɛkɛsɛkɛli min bilala a kɔnɔ, o seginna a ma sara.

Mun na mɔgɔ ɲininikɛla ye miniti 30 wideyow weleli lakika kɛ ni ne ye Zoom/Google Meet kan n’u tun ye Kore Worodugu Lazarus hakɛriw ye?¶

RPDC ka ** .`Contagious Interview` (`UNC4899` / . `Famous Chollima`)** baarakɛlaw bɛ tubabukan fɔbagaw ta ka ɲɛ walasa ka HR sɛgɛsɛgɛli weleli kɛ minnu bɛ mɔgɔ dalen to a la, minnu bɛ kɛ miniti 20 fo miniti 45 kɔnɔ Zoom, Google Meet walima Calendly kan. Sabula developpeur kelen ka baarakɛyɔrɔ bɛ to ka minɛ `$50,000 to $2,000,000+` in DeFi protocol keys, treasury multisig access, walima corporate cloud production credentials, ka miniti 30 kɛ wideyo weleli ɲɛnama dɔ la walasa k’i lasun i ka boli `npm install` u ka jateminɛ kan repo bɛ nafa caman sɔrɔ wari bilalen na bagabagali kɛbaga fɛ.

Ni "baarakɛla" ye wari ci n ka banki jatebɔsɛbɛn kɔnɔ ACH/Zelle fɛ, k'a ɲini n fɛ n ka wari bɔ walima ka Bitcoin san walasa k'a ci u ka kiliyan ma do?¶

O ye **Wari Mule (`Layering`)** opereli. A tɛ i n’a fɔ papiye sɛgɛsɛgɛli (min bɛ pan ka sɔrɔ ka sigi), ni `$4,000` tiɲɛ na sera i ka jatebɔsɛbɛn kɔnɔ via `ACH`, . `Zelle`, walima `Wire`, **o `$4,000` sonyalen don ka bɔ hacking walima romance-scam victim jalakibali dɔ ka banki jatebɔsɛbɛn kɔnɔ**. N'i y'a bɔ walima k'a sɛmɛntiya ka kɛ Bitcoin ye i ka "baarakɛla" ye, sariyatigiw ni jatigɛwalekɛla ka banki bɛ wari sonyalenw nɔfɛtaama ka taa i ka banki jatebɔsɛbɛn kɔnɔ. Aw kana santimɛtɛrɛ kelen bɔ walima ka taa ɲɛfɛ; aw bɛ aw ka banki ka nanbarako ɲɛmɔgɔso wele joona, k’a ɲini u fɛ u ka wari bilali yamaruyabali segin a bɔyɔrɔ la.

--- .

Gafe minnu bɛ tali kɛ o ko la¶

• Baarakɛlaw ka nanbara nkalonma, minɛnw sɛgɛsɛgɛli nanbara, ani onboarding identité sonya
• Supply chain npm/PyPI pake bɛnkan ani developpeur baarakɛyɔrɔ kilisi jiginni
• Session cookie hijacking, infostealer malware, ani passkey bɔli
• CAPTCHA nkalonma ClickFix PowerShell Win+R klipbɔri porogaramu jugu ani Lumma Infostealer ɲɛnabɔli
• Cryptocurrency portefeuille drain ani kisɛ kumasen bɛnkan
• Push payment (APP) app nanbarako yamaruyalen: Zelle, Venmo, ani Faster Payments ka mɔgɔya kɛcogo ani wari seginni hakɛw
• Identité sonya jaabi
• Kɔrɔtɔko nimɔrɔw ka kɛɲɛ ni jamana ye

--- .

Sosow ani ɲɛmɔgɔyaso ka bilasiralikan¶

• Fɛdɛrali ka sɛgɛsɛgɛli biro (FBI), Sibɛri lakanani ni fɛnsɔrɔsiraw lakanani baarada (CISA), & DoD ka Sibɛri juguya yɔrɔ (DC3) (Amerika): Ladilikan jɛlen: Kore Worodugu (DPRK) Kanpaɲi minnu bɛ kɛ ka ɲɛsin porozɛw dilannikɛlaw ma (Contagious Interview / . BeaverTail / . InvisibleFerret) ye.
• Palo Alto Réseaux Unit 42 (unit42.paloaltonetworks.com): Kore worodugu ka bagabagali kɛbagaw ye Tech baara ɲinibagaw lafili ka kɛ mɔgɔ nkalontigɛlaw ye (Contagious Interview Sɛgɛsɛgɛli).
• Fɛdɛrali Jago Komisiɔn (FTC) & Federal Reserve Board (Etazuni): Ladilikan minnu bɛ di mɔgɔw ma, minnu bɛ tali kɛ fake Check Scams, Parcel Mules, ani... Regulation CC (12 CFR Part 229) Sariyaw.
• U.S. jamanadenw ka jamanadenw ni bɔnɔgɔla baarakɛlaw (USCIS): * .myE-Verify Self Lock Identity Lakanali Ladilikan*.
• Jamana ka Sibɛri Lakanali yɔrɔ (NCSC) & Action Fraud (Royaume-Uni): Ka sariya juguw marayɔrɔw nɔgɔya ani ka nanbara kɛ baarakɛlaw ɲinini na.