Bayar Aiki na Karya da Zamba na Hira Mai Nisa: Li'azaru na Koriya ta Arewa BeaverTail npm Repo Malware, Binciken Kayan Aikin Karya, da Kulle Identity¶

Gane kai tsaye a tsakiyar hirar aiki mai nisa ko tsarin shiga jirgin cewa "mai daukar ma'aikata" ko "mai kula da hayar" yana gudanar da ƙwararrun hanyar yanar gizo ko tarkon kuɗi wani gaggawa ne na gaba biyu. Yau zamba na aiki mai nisa ya kasu kashi biyu ayyuka masu lalacewa da FBI, CISA, da hukumomin yanar gizo na duniya suka gano: (1) ** Mai Haɓakawa Software da Crypto "Assessment Code" Malware (Contagious Interview / DPRK Ƙungiyar Lazarus BeaverTail & InvisibleFerret***, inda mai daukar ma'aikata akan LinkedIn, Upwork, ko Telegram ya nemi injiniyan software ko dan takarar Web3/AI da ya rufe wurin ajiyar GitHub, GitLab, ko Bitbucket kuma ya gudu. npm install && npm start (ko Python/Docker ginawa) akan kwamfutar tafi-da-gidanka na farko don "gyara bug kafin hira ta kai tsaye," yin shiru yana aiwatar da wani mai satar bayanai wanda ke fitar da kowane kuki na zaman mai bincike, mai sarrafa kalmar sirri, .ssh key, .env fayil, da walat ɗin cryptocurrency a ƙarƙashin 5 seconds; da (2) Binciken karya "Kayan Gidan Gida" da Maimaita Zagin Alfasha, inda wani kamfani da aka kwaikwayi ke gudanar da hira ta rubutu/Kwagogi, aika imel na jabu. $2,500 to $5,000 duba "MacBook Pro da saitin ofis ɗin gida," kuma yana ba ku umarni da wayar hannu-ajiye cak ɗin kuma aika $2,200 ta hanyar Zelle, Venmo, waya, ko katunan kyauta ga "mai siyar da kayan aikin IT da aka yarda" kafin cak ɗin ya billa kwanaki daga baya. Don shiga cikin SSN/I-9 sata na ainihi da zamba na gaba ɗaya, duba aikin jabu yana ba da zamba, damfara na kayan aiki, da satar shaidar shiga jirgi; don npm/PyPI jujjuya maɓalli na fakitin da satar kuki mai bincike, tuntuɓi sarkar samar da npm/PyPI daidaitawa da jujjuyawar maɓalli na wurin aiki kuma Satar kuki na zaman, malware infostealer, da soke maɓallin wucewa. Idan kuna fuskantar tilastawa ta jiki nan take, barazanar swatting, ko adawar masinja ta cikin mutum, kira lambar gaggawa ta gida (911 a Amurka da Kanada, 112 a fadin Tarayyar Turai, 999 a Ƙasar Ingila) ko duba kundin adireshin mu na lambobin gaggawa.

Yi wannan yanzu¶

1. **IDAN KA GUDU npm install, npm test, yarn, pip install, ko Zuƙowa/Kungiyoyi/Miro na karya .dmg/.exe don hirar aiki: CUTAR DA KWAMFUTA DAGA WI-FI DA ETHERNET A CIKIN 3 seconds ***:
2. Cire kebul na Ethernet ko kunna Wi-Fi ** KASHE *** nan take.
3. Na BeaverTail JavaScript/Node.js zazzagewar kayan aiki mai ɗaukar hoto yanayin Python mai ɗaukar hoto (-/.npl ko %UserProfile%\.pyp) kuma ya fara aiwatar da InvisibleFerret bayan gida, wanda ke haɗa zuwa umarni da sarrafawa (C2) uwar garke (:1224 / :1244) yawo da maɓallan maɓallin ku, allo, da tsarin fayil kai tsaye.
4. Yi amfani da keɓantaccen, wayo mai tsabta (iPhone ko Android akan bayanan salula) don fitar da duk walat ɗin cryptocurrency da soke kowane zaman bincike mai aiki (Google, GitHub, AWS, Microsoft, Apple*:
5. BeaverTail hari ** MetaMask, Phantom, Rabby, Coinbase Wallet, Trust Wallet, Fitowa, Electrum, da Solana CLI (-/.config/solana/id.json*** fayilolin vault, tare da Login Data kuma Cookies daga Chrome, Brave, Edge, Arc, da Firefox, da macOS login.keychain-db.
6. Daga na'ura mai tsabta, canja wurin duk wani kadarorin crypto akan walat masu zafi zuwa sabon nau'in walat ɗin kayan masarufi, soke duk zaman yanar gizo mai aiki a cikin Google (myaccount.google.com/security), GitHub (github.com/settings/sessions), da AWS/Cloud consoles, kuma share maɓallan SSH da GPG ɗin ku daga GitHub/GitLab.
7. IDAN KA IYA KASANCEWA TAMBAYOYIN "KAYAN GIDA" DAGA MA'AIKI: KAR KA AIKA DOLLAR DAYA GA WANI "MAI SAI" KUMA KA KIRA SASHEN ZAMAN BANKI NAN TAKE:
8. Ko da app ɗin ku na banki ya nuna $3,500 duba kamar yadda "Samar Ma'auni / An Sakin Kudade," an share kuɗin ** BA a share ba. Karkashin Asusun Tarayyar Amurka Dokar CC (Expedited Funds Availability Act*, bankuna dole ne su sanya rajistan ajiya na ɗan lokaci a ciki 1 to 2 business days, yayin da gano cewa rajistan routing/lambar account na jabu yana ɗaukar 5 to 14 business days.
9. Ka kira lambar da ke bayan katin zare kudi sannan ka bayar da rahoto: *"Damfara ce ta duba aikin yi ta yi min niyya kuma na ajiye cakin da ake zargin jabu ne ba tare da sani ba.
10. IDAN KA TIGA KA AIKA ZELLE, VENMO, WIRE, KO KUDIN ATM BITCOIN ZUWA GA "MAI SALLAR KAYAYYA": Kira Teburin Tunawa da Zamba/ Waya na bankin ku nan take (don wayoyi, nemi gaggawar gaggawa SWIFT / Fedwire Recall da FBI IC3 Recovery Asset Team daskare; don Biyan Kuɗi na Zelle/Mafi Sauri, bayar da rahoton ** Biyan Biyan Izinin Izinin (APP) zamba na kwaikwayi aiki** karkashin iznin tura biyan kuɗi app zamba da haƙƙin biyan kuɗi).
11. IDAN KA YI SSN ɗinka, fasfo, lasisin direba, W-4, I-9, KO LAMBAR BANZA DEPOSIT DEPOSIT LAMBAR: Sanya daskarewar kuɗi a Equifax, Experian, da TransUnion, daskare ** ChexSystems**, kulle SSN naka akan ChexSystemsmyeverify.uscis.gov**, kuma ka nemi bankinka ya rufe lambar asusun ajiyar da aka fallasa sannan ka bude lambar asusu mai sauyawa.
12. IDAN KA KARBI "KASHIN BINCIKE / MAI GABATAR DA SANA'A" AYYUKAN KARBAR DA MAYARWA DA KASHI DAGA GIDA: TSAYA BAYANIN TUSHEN NAN nan take: Waɗancan na'urorin lantarki (iPhones, MacBooks, camera lenses) an sayo su da katunan kuɗi na sata kuma an tura su zuwa adireshin gidanku (Parcel Mule Scam). Ajiye duk alamun jigilar kaya da rajistan ayyukan taɗi kuma tuntuɓi 'yan sanda na gida ko ** Sabis na Binciken Wasiƙar Amurka (USPIS)**.

Bishiyar yanke shawara: hira mai nisa da aikin gaggawa na karya¶

Yi amfani da wannan jadawali don tsalle kai tsaye zuwa ƙa'idar ƙullawa wanda ya dace da ainihin bambance-bambancen zamba da kuka ci karo da su:

flowchart TD
    Start["Gaggawa: Tambayoyin Ayuba na Ƙarya da ake zargi, Gwajin Coding, ko Zamba"] --> ScamType{"Menene 'Mai daukar ma'aikata' ko 'Mai Aiki' suka neme ku?"}

    ScamType -->|"1. Clone a Git Repo & Run npm / Python / Docker KO Sanya App na Kiran Bidiyo na Musamman"| DevTrap["M: DPRK Hira Mai Yaɗuwa (BeaverTail / InvisibleFerret) Bayani-Stealer"]

    ScamType -->|"2. Ajiye Chek (PDF/Mail) & Aika Kuɗi zuwa 'Mai Siyar da Kayan Kayan da Aka Amince'"| CheckTrap["Zamba na Biyan Biyan Kuɗi na Ƙarya: Duban Ƙididdigar Ƙididdigar Ƙididdigar Ƙididdigar Ƙididdigar Ƙididdigar Ƙididdigar Ƙididdigar Ƙirar Ƙirar Ƙirar Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙiƙwalwar Ƙi zai Billa a cikin Kwanaki 5-14"]

    ScamType -->|"3. Cika Fitar I-9 / W-4 / SSN / Fasfo / Form Deposit Kai tsaye Kafin Gano Zamba"| IdTrap["Identity na Shiga & Satar Biyan Kuɗi: Daskare Kiredit, ChexSystems, IRS IP PIN, & Account Account"]

    ScamType -->|"4. Karɓi Fakiti a Gida, Bincika su, & Sayar da Takaddun Takaddun Samfura KO Biyan 'Task' Crypto"| MuleOrTask["Sake Jigilar Alfadara KO 'Inganta Aikace-aikacen' Zamba na Ayyukan Crypto"]

    DevTrap --> CutNet["1. Kashe Wi-Fi / Cire Ethernet Nan da nan akan Wurin Aikin Haɓaka"]
    CutNet --> EvacPhone["2. A Waya Tsaftace: Matsar da Kayayyakin Crypto + Soke Zama na Google/GitHub/AWS + Juya Maɓallan SSH"]
    EvacPhone -->ForensicClean["3. Duba -/.npl, -/.pyp, package.json, & Profiles Browser -> Shafa & Sake Sanya OS Tsabtace"]

    CheckTrap --> SentMoney{"Shin Kun riga kun Aika Kuɗi zuwa 'Mai Siyar da Kayan Aiki'?"}
    SentMoney -->|"A'a: Duba Adadin, An aika $0"| WarnBank["KAR KU TABA KUDADE -> Kiran Zamba na Banki Nan da nan don Bada Tutar Kuɗi mara Kyau."]
    SentMoney -->|"Ee: An aika ta Zelle / Waya / Crypto / Katunan Kyauta"| RecallFunds["Kira Wayar Banki/Desk ɗin Zamba Nan da nan -> Rufe Ƙirar Kuɗi Kafin Bincika Bounces -> Rahoton IC3 Fayil"]

    IdTrap --> LockCredit["Daskare Equifax/Experian/TransUnion + ChexSystems -> Rufe Lamban Asusu na Banki -> Kulle myE-Tabbatar"]
    MuleOrTask --> StopShip["Dakatar da Mayar da Fakitin & Dakatar da Adadin Crypto -> Kiyaye Kuɗi & Rahoto zuwa USPIS / IC3"]

Mataki na 1: Yadda manyan tarko biyu masu nisa ke aiki a ƙarƙashin kaho¶

Kwatanta injiniyoyin fasaha da alamun jajayen tuta na manyan hanyoyin gaggawa na gaggawa guda uku masu aiki a duk duniya:

Mataki na 2: Amsar Gaggawa ga Masu Haɓaka Software (Contagious Interview / BeaverTail / InvisibleFerret)¶

Idan kai mai haɓaka software ne wanda ya rufe wurin ajiya daga mai daukar ma'aikata ko mai tambayoyi kuma ya gudu npm install, npm start, yarn, pnpm, python, cargo, ko kuma wanda za'a iya aiwatarwa akan Windows, macOS, ko Linux workstation, bi wannan ainihin jerin martanin da ya faru dangane da ** Palo Alto Networks Unit 42**, CrowdStrike, da CISA/FBI barazanar leken asiri akan Koriya ta Arewa Contagious Interview yakin neman zabe.

Mataki 1: Fahimtar Mataki na 2 BeaverTail -> InvisibleFerret Kashe Sarkar akan faifan ku¶

Ta yaya ma'ajiyar React/Node.js da alama al'ada ta yi cuta da Mac ko PC ɗin ku ba tare da haifar da bullar riga-kafi ba?

+-------------------------------------------------------------------------+
| ANATOMY OF A CONTAGIOUS INTERVIEW (BEAVERTAIL) MALICIOUS REPO           |
|                                                                         |
| 1. The Decoy Repo (e.g., "mern-ecommerce-assessment" or "defi-dex-ui"): |
|    - 99% of the repo is real, working React/Express boilerplate code.   |
|    - Hidden at the very end of `server/routes/api/auth.js` or           |
|      `backend/controllers/userController.js` (often scrolled 300 spaces |
|      to the right on one line so you do not see it in VS Code) is an    |
|      obfuscated `eval(Buffer.from(...))` or `axios.get(...)` call.      |
|                                                                         |
| 2. Stage 1: BeaverTail (JavaScript Info-Stealer inside Node.js):        |
|    - Scans Chrome, Brave, Opera, Edge, Vivaldi (`Default` & `Profile N`)|
|      for `Login Data`, `Local Extension Settings` (MetaMask `nkbihfbeog`|
|      Phantom `bfnaelmome`, Rabby `acmacodkjb`), and Solana `id.json`.   |
|    - Uploads stolen vaults & cookies immediately to `http://<C2>:1224`. |
|                                                                         |
| 3. Stage 2: InvisibleFerret (Python Backdoor + AnyDesk Persistence):    |
|    - BeaverTail downloads a standalone portable Python 3.11 zip into    |
|      `~/.npl/` or `%UserProfile%\.pyp\` and runs `~/.npl/.pyp/python`   |
|      executing `~/.npl/main.py` (`InvisibleFerret`).                    |
|    - InvisibleFerret logs keystrokes, reads your clipboard, scans your  |
|      entire drive for `.env`, `.ssh`, `seed`, `mnemonic`, and silently  |
|      downloads/configures `AnyDesk` for full remote desktop control.    |
+-------------------------------------------------------------------------+

Mataki na 2: Duba ga ainihin BeaverTail kuma InvisibleFerret Ma'anoni na Amincewa (IoCs)¶

Yayin da Mac, Linux, ko Windows kwamfutar da ke kamuwa da ita gaba ɗaya ta katse daga Wi-Fi da Ethernet, buɗe tasha (ko PowerShell) don bincika ko mataki na 2 (InvisibleFerret) an jefar a kan faifan ku:

# On macOS or Linux (WITH WI-FI OFF):
ls -la ~/.npl ~/.pyp ~/.vscode
ps aux | grep -iE "npl|pyp|main\.py|anydesk|node"

# Search the cloned interview repository for hidden horizontal-scroll obfuscation or base64 evals:
grep -rnE "Buffer\.from|child_process|execSync|\.npl|\.pyp|:1224|:1244|nkbihfbeogaeaoehlefnkodbefgpgknn" /path/to/cloned/interview_repo/

# On Windows PowerShell (WITH WI-FI / ETHERNET OFF):
Get-ChildItem -Path $env:USERPROFILE -Force | Where-Object { $_.Name -match "^\.(npl|pyp)" }
Get-Process | Where-Object { $_.Path -match "npl|pyp|AnyDesk" }

Mataki na 3: Ƙaddamar da Ƙwararrun Ƙwararrun Ƙwararrun Ƙwararru na Minti 15 & Ƙwararrun Crypto (Daga Na'urar Tsabtace)¶

Kar *** a buga sabbin kalmomin shiga ko jimlolin iri akan kwamfutar da ta kamu da cutar. Amfani da wayar salula mai tsabta iPhone / Android) ko kuma wata kwamfuta daban da ba ta daidaita ba:

1. ** Kware duk Wallet ɗin Cryptocurrency nan da nan (Minutes 0 to 5***:
2. Ko da MetaMask, fatalwa, Rabby, ko walat ɗin Fitowa an kulle shi da kalmar sirri, BeaverTail ɗora fayil ɗin vault ɗin ku da aka ɓoye (000003.log / LOCK / Local Extension Settingskuma* InvisibleFerret yana gudanar da saka idanu na keylogger / allo (kuma akan macOS yana fitowa ɗan asalin karya osascript maganganun kalmar sirri da ke neman kalmar wucewar tsarin Mac ɗin ku don buɗewa login.keychain-db).
3. Ƙirƙiri sabon walat akan ** wallet ɗinku ko kayan masarufi (Ledger / Trezor)** tare da ** sabuwar-sabon jumlar kalma 12/24** da canja wurin kashi 100 na alamun ku, NFTs, da matsayi daga kowane walat ɗin da ya taɓa wannan kwamfutar.
4. ** Soke duk GitHub, GitLab, Bitbucket, da Cloud (AWS / GCP / Azure / Vercel) takardun shaida (Minutes 5 to 10***:
5. ** GitHub**: Shiga cikin wayarka -> ** Saituna -> SSH da maɓallan GPG** -> ** Share** kowane maɓallin SSH da aka adana a ciki. -/.ssh/ a kan kwamfutar tafi-da-gidanka mai cutar. Daga nan sai a je zuwa Settings -> Developer settings -> Personal access tokens ( soke dukkan alamu) da Settings -> Sessions -> Sake duk zaman.
6. ** AWS / GCP / Cloud ***: Nan da nan kashe kowane AWS_ACCESS_KEY_ID adana a -/.aws/credentials ko cikin wani .env fayil akan kwamfutar tafi-da-gidanka (InvisibleFerret recursively yana rarrafe kowane babban fayil ɗin aikin akan tuƙi don .env, .npmrc, .pypirc, kubeconfig, kuma id_rsa).
7. **Idan kuna da Ma'ajiya ko Maɓallai na Abokin Ciniki akan kwamfutar tafi-da-gidanka ***: Sanar da Cibiyar Tsaro ta Mai aiki (SOC / CISO) nan da nan don su iya juya kamfanoni .env sirri da bincike aikata.
8. ** Murke duk Zauren Mai Rarraba (Browser)Google, Microsoft, Apple, Slack, Discord, Telegram) (Minutes 10 to 15***:
9. Tuna: canza kalmar sirri sau da yawa ** baya** bata kukis ɗin da aka sata sai dai idan kun danna ''Fita daga duk na'urori / soke duk zaman'** a cikin Tsaron Google, Asusun Microsoft, Slack, Discord, da X/Twitter.
10. Canja Mai sarrafa kalmar wucewa ta 1Password, Bitwarden, Keeper* babban kalmar sirri kuma soke alamar na'urar da aka ba da izini ta kwamfutar tafi-da-gidanka.
11. ** Shafa kuma Sake shigar da tsarin aiki akan Wurin Aiki da ya kamu da cuta ***: Domin InvisibleFerret yana shigar da ayyuka na baya-bayan nan na dindindin, yana gyara binaries, da faɗuwa AnyDesk hanya mai nisa, kawai sharewa -/.npl kuma ma'ajiyar cloned bai isa ba. Ajiye kawai filayen takaddun bayanai/fayilolin tushen (an tabbatar da tsabta tare da git status / git diff), sannan aiwatar da cikakken gogewar OS mai tsabta kuma sake shigar (macOS Erase All Content and Settings ko Windows USB tsaftataccen bangare share).

Mataki na 3: Amsar Gaggawa don "Kayan Aikin Gidan Gida" Duba zamba¶

Idan an ba ku aiki mai nisa (Administrative Assistant, Data Entry, Customer Support, Project Coordinator, Graphic Designer), an karɓi cak (ta hanyar imel ɗin PDF don bugawa da ajiyar kuɗi ta hannu, ko ta hanyar FedEx/UPS na dare ambulan) don siyan kwamfutar tafi-da-gidanka da kayan aikin ofis na gida, da saka shi cikin asusun bankin ku, kuna cikin tsere da Federal Reserve checking check tagan dawo.

1. Me yasa app na banki ya ce "Kudade Akwai" akan cak na karya 100% (The Regulation CC Float Trap)¶

+-------------------------------------------------------------------------+
| HOW THE FAKE "EQUIPMENT CHECK" FLOAT TRAP WORKS                         |
|                                                                         |
| Day 1 (Monday): You deposit the scammer's $3,500 "Equipment Check"      |
|                 using your bank's Mobile Deposit app.                   |
| Day 2 (Tuesday): Under US Federal Law (Regulation CC), your bank MUST   |
|                  release the funds within 1-2 business days. Your app   |
|                  now shows: "Available Balance: +$3,500.00".            |
| Day 2 (Tuesday PM): "Hiring Manager" tells you to Zelle/Wire $2,800     |
|                     immediately to their "Approved MacBook Vendor" so   |
|                     your laptop arrives by Friday.                      |
| Day 8 (Next Tuesday): The real corporate bank whose routing/account     |
|                       number was forged on the check rejects it as      |
|                       COUNTERFEIT / ALTERED (`Return Code R29 / Refer   |
|                       to Maker`).                                       |
| RESULT ON DAY 8:                                                        |
|   - Your bank claws back the full $3,500.00 from your balance.          |
|   - The $2,800 you sent via Zelle/Wire is gone forever.                 |
|   - Your account drops to -$2,800.00 overdraft, and your bank's risk    |
|     algorithm may freeze/close your account and report you to           |
|     ChexSystems as a check-fraud risk.                                  |
+-------------------------------------------------------------------------+

2. Mataki-mataki ƙa'idar kariyar banki idan kun saka cak ɗin¶

Case A: Kun ajiye cak ɗin, amma ba ku aika da kuɗi ga “mai siyarwa” ba tukuna¶

** Ka yi hasara $0 Ya zuwa yanzu, kuma za ku iya hana bankin ku rufe asusunku idan kun yi aiki a yanzu:** 1. KADA a cire, kashe, ko canja wurin kashi ɗaya na kuɗin cak ɗin da aka ajiye. Bar cikakken $3,500 zaune ba a taɓa shi ba a cikin asusun ta yadda lokacin da cak ɗin ya billa a cikin kwanaki 5 zuwa 10 na kasuwanci, bankin ya dawo da nasa kiredit na wucin gadi da tsabta tare da $0 overdraft. 2. Kira Sashen Zamba na bankinku nan da nan (ko shiga cikin reshe na zahiri kuma kuyi magana da Manajan Reshe): - Lokacin da rajistan jabu ya billa shiru ba tare da bayani ba, injin haɗarin banki mai sarrafa kansa (Early Warning Services / ChexSystems) ba zai iya sanin ko kai ne mai zamba ko wanda aka azabtar da mai neman aikin ba. - Faɗa wa wakilin bankin a fili: *"Na nemi aiki mai nisa kuma mai zamba ya aiko mani da cakin kayan aikin '$3,500' da na ajiye ta wayar hannu a yau. Na gane cewa zamba ce ta aikin karya. Ban kashe ko canja wurin dala ɗaya na kudaden ba. Da fatan za a sanya bayanin zamba na Aiki a kan bayanin martaba na kuma a juyar da / riƙe asusun ajiyar kuɗi na wucin gadi. - Tambayi banki don yafe $15 to $35 An dawo da Kuɗin Abun da aka Adana kuma tabbatar da cewa ba za a yi wa asusun ku alamar rufewa ba.

Case B: Kun ajiye cak ɗin kuma kun riga kun aika kuɗi (Zelle, Venmo, Wire, Cash App, Crypto, ko Gift Cards)¶

1. Kira Ma'aikatar Zamba ta bankin ku a cikin daƙiƙa 60:
2. Bayar da rahoton ɓangarori biyu na laifin: (a) ajiyar rajistan shiga shine rajistan zamba na aikin yi na jabu wanda zai yi billa, kuma (b) canja wurin Zelle / Venmo / Waya / ACH mai fita ya haifar da zamba.
3. ** Idan ka aika Wayar Banki (Fedwire / SWIFT) a cikin sa'o'i 24 zuwa 72 da suka gabata : Neman gaggawa ** Tunawa da Waya ta yaudara (SWIFT MT192 / pacs.004 da kuma shigar da rahoton gaggawa a ic3.gov don haka FBI's ** Teamungiyar Kadara ta Farfadowa (RAT*** zai iya fitar da sarkar Kisan ZambaFFKC) daskare akan asusun alfadari mai karɓa.
4. Idan ka aika Zelle, Venmo, ko UK Faster Payments: Yi fayil ɗin biyan kuɗi mai iziniAPP) da'awar zamba** da kuma neman cikakkun bayanan hanyar banki/ma'aikata na banki (Zelle Network Fraud).
5. **Idan mai zamba ya gaya muku siyan Apple, Razer Gold, Steam, ko Katunan Kyautar Kyauta ***: Kira layin zamba na mai bayarwa katin kyauta nan da nan tare da jerin lambobin da aka karɓa don daskare duk ma'auni na katin da ba a biya ba.
6. **Shirya don $3,500 duba clawback don haka asusunku kada ya koma cikin cajin ChexSystems ***:
7. Lokacin karya $3,500 duba bounces a cikin kwanaki 5 zuwa 10, bankin ku zai cire $3,500 daga asusun ku. Yi aiki tare da ƙungiyar dawo da zamba ta bankin ku don saita tsarin biyan kuɗi na sifili don kowane ma'auni mara kyau kafin ranar 30 don haka bankin baya bayar da rahoton rufe asusun da ba son rai ba ga ChexSystems ko ** Sabis na Gargaɗi na FarkoEWS)**.

Mataki na 4: Kulle ainihin ku idan kun ƙaddamar da wani I-9, W-4, SSN, Fasfo, ko Form Deposit Kai tsaye¶

Masu daukar ma'aikata na karya kusan ko da yaushe suna aika "Packet Onboarding" (Form W-4, Form I-9, Direct Deposit Authorization, da hotuna na gaba da baya na lasisin tuƙi, Fasfo, ko Katin Tsaron Jama'a) kafin fara cak ko tarkon malware. Idan kun aika da ɗaya daga cikin waɗannan takaddun, aiwatar da wannan kulle-kulle na matakai 5 a yau:

1. Rufe lambar asusun banki da aka fallasa (Direct Deposit form): Fom ɗin ajiya kai tsaye yana bawa mai damfara lambar Bank Roting NumberABA) da cikakken Checking Account Number**, da kwafin cak ɗin da ba daidai ba tare da sa hannunka, wanda shine duk abin da ake buƙata don buga cak ɗin takarda na yaudara ko fara ba tare da izini ba. ACH Debit janye daga asusun ku. Faɗa wa bankin ku don rufe waccan lambar asusun kuma matsar da kuɗin ku zuwa sabon-sabon lambar asusun ciki.
2. ** Sanya Daskarewar Kiredit kyauta a duk ofisoshin kiredit guda uku ***:
3. Equifax (equifax.com/personal/credit-report-services/credit-freeze/ / 1-888-298-0045)
4. ** Gwani** (experian.com/freeze/ / 1-888-397-3742)
5. TransUnion (transunion.com/credit-freeze / 1-800-916-8800)
6. ** Daskare ChexSystems (chexsystems.com) kuma NCTUE**: Bankuna suna amfani da ChexSystems (ba Equifax/Experian) lokacin da wani ya buɗe asusun dubawa da sunan ku. Sanya Daskare Tsaro na ChexSystems kyauta* akan layi don haka masu zamba ba za su iya buɗe asusun banki na alfadara ta amfani da lasisin tuƙi da aka sace da fakitin I-9 ba.
7. Kulle Social Security Number a ciki myE-Verify (USCIS*: Je zuwa myeverify.uscis.gov kuma kunna Self Lock, wanda ke hana kowa yin amfani da SSN ɗin ku a cikin tsarin E-Tabbatar da aikin yi na tarayya.
8. Saba wani IRS Identity Protection PIN (IP PIN) (irs.gov/ippin*: Hana ƴan damfara yin shigar da sunan dawo da haraji na yaudara da sunan ku ta hanyar yin rajista a lamba 6 IRS IP PIN nan take.

Mataki na 5: Dakatar da "Parcel Reshipping Alfadara" ko "Aikin Crypto" zamba cikin aminci.¶

Idan an ɗauke ku aiki ɗaya daga cikin waɗannan zamba na aiki na nesa fa?

Yanayi na 1: Kun karɓi aikin "Kwana inganci / Fakitin Canjawa" kuma kuna da fakiti a gidanku¶

Idan kun karɓi MacBooks, iPhones, ko lantarki a adireshin gidanku kuma an ba ku alamun jigilar kaya na USPS/UPS/FedEx PDF wanda aka riga aka biya don tura su: - ** TSAYA fakitin jigilar kaya nan da nan ***. Duk wani kunshin da ya isa gidan ku, an sayo shi ta hanyar amfani da katin kiredit na sata inda mai zamba ya shigar da ** sunan ku da adireshin gidanku ** a matsayin Ship To adireshin - **KADA KA mayar da fakitin zuwa adireshin mai zamba *: Ajiye akwatunan da ba a buɗe ba, adana kowane imel, Taɗi na Telegram, lakabin jigilar kaya PDF, da kwangilar aiki a matsayin shaida, kuma tuntuɓi 'yan sanda na gida da ** US Sabis ɗin Binciken Wasiƙa (1-877-876-2455 / uspis.gov (ko ** Zamba a Burtaniya) don shirya dawo da hajar ga dillalan da aka damfara.

Hali na 2: An ɗauke ku ta WhatsApp/Telegram don "Ƙara Haɓaka App / Ƙimar Samfura" Ayyukan Aiki na Crypto¶

• **Yadda tarkon ke aiki ***: "Mai aiki" yana biyan ku $50 to $150 a zahiri USDT a rana ta 1 don danna maɓalli a cikin gidan yanar gizon karya. A Rana ta 2 ko Rana ta 3, asusunku ya buga "Aikin Haɗuwa" wanda ke sanya ma'aunin tashar ku a -$400 kuma yana buƙatar ka saka ajiya $400 na ku USDT don "kammala saitin ayyuka 40." Lokacin da kayi ajiya $400, aiki na biyu yana buƙata $1,800, sannan $6,000, sannan $25,000 don "haraji."
• Mataki na Gaggawa: ** DAINA saka cryptocurrency nan da nan**. Lambobin da ke kan gidan yanar gizon ɗawainiyar ƙa'idodin HTML na karya ne wanda mai zamba ke sarrafawa; biyan ma'auni mara kyau ba zai taɓa buɗe janyewa ba. Kashe duk abokan hulɗa kuma ka guji "masu fashin kwamfuta na dawo da crypto" akan Telegram ko Instagram.

Lambobin gaggawa na yanki da ka'idojin hukumar¶

Ba da rahoton malware na hira mai nisa (Contagious Interview), bincikar zamba, da satar shaidar shiga cikin jirgi ga hukumomin yanar gizo da hukumomin kuɗi a yankinku:

• Amurka da Kanada: Dial 911 ga kowane gaggawar lafiyar jiki. Ba da rahoton mai haɓaka malware (Lazarus / BeaverTail) da kuma binciken aikin karya / asarar aiki ga FBI IC3 (ic3.gov, da FTC (ReportFraud.ftc.gov kuma IdentityTheft.gov, da kuma USPIS (1-877-876-2455). A Kanada, tuntuɓi ** Cibiyar Yaƙin Zamba ta Kanada (1-888-495-8501*** da ** Cibiyar Tsaro ta Intanet ta Kanada (Cibiyar Tsaro ta Intanet).1-833-CYBER-88)**.
• ** United Kingdom : Dial 999 ga gaggawa ko 101 ga 'yan sanda na gida. Dial159 don haɗawa da sashin zamba na bankin ku, kuma ku ba da rahoton zamba na aikin karya da masu haɓaka malware zuwa ** Zamba (Zamba)0300 123 2040 / actionfraud.police.uk*** da kuma NCSC (ncsc.gov.uk). Yi la'akari da ** Rijistar Kariyar CIFAS (cifas.org.uk)**.
• Ƙungiyar Tarayyar Turai: Dial112* a duk ƙasashe membobin EU, sanar da teburin bankin ku nan da nan, kuma ku shigar da rahoto tare da ƙungiyar 'yan sandan ku ta yanar gizo da CSIRT na ƙasa.
• ** Ostiraliya da New Zealand ***: Kiran kira 000 a Ostiraliya ko 111 in New Zealand. Rahoton aiki da zamba ga Scamwatch (scamwatch.gov.au, ReportCyber (cyber.gov.au, 1300 CYBER1, da kuma tuntuɓar IDCARE (1800 595 160 in AU/ 0800 121 068 da NZ).
• **Indiya da Asiya-Pacific : Kiran kira 112 a Indiya don abubuwan gaggawa kuma kira ** Layin Taimako na Laifukan Intanet na Kasa1930 / cybercrime.gov.in nan da nan don daskare musayar banki na yaudara. A cikin Singapore, kira Anti-Scam Helpline1799).

Tambayoyin da ake yawan yi¶

Na rufe ma'ajiyar GitHub mai daukar ma'aikata (git clone ...), buɗe fayilolin a cikin VS Code don karanta su, kuma KABA gudu npm install ko npm start. Har yanzu na kamu da cutar?¶

Sabanin `npm install` (wanda ke gudana `package.json` scripts), gudu babu `git clone` da karatu a sarari `.js` fayiloli baya aiwatar da code da kanta SAI ma'adanar ta ƙunshi ɓarna `.vscode/tasks.json` fayil da `"runOn": "folderOpen"` KUMA kun danna "Ee, na amince da marubuta" lokacin da lambar VS ta buɗe babban fayil ɗin. Duba idan a `.vscode/tasks.json` akwai fayil ɗin a cikin cloned repo (`cat /path/to/repo/.vscode/tasks.json`) kuma duba idan `-/.npl` ko `-/.pyp` an ƙirƙira shi a cikin kundin adireshin gidan ku. Idan babu kuma ba ku taɓa gudu ba `npm`, `yarn`, `python`, ko `node`, tsarin ku bai aiwatar da aikin biya ba: kawai share babban fayil ɗin cloned.

Mene ne idan na gudanar da gwajin coding na hira a cikin akwati Docker (docker compose up) a kan Mac ko Windows PC? Kwandon ya kare ni?¶

Ya dogara da waɗanne kundin aka ɗora a ciki `docker-compose.yml` ko kuma `Dockerfile`. Idan kun gudanar da akwati tare da keɓantaccen tsarin fayil, malware ɗin ba zai iya ganin kukis ɗin Chrome ɗinku ko tsawo na MetaMask ba. Duk da haka, da yawa `Contagious Interview` wuraren ajiya sun hada da a `docker-compose.yml` wanda ke daure a asirce-majiye kundin adireshin gidan mai masaukinku (`volumes: - -/.ssh:/root/.ssh` ko `- -/:/host_home`) ko gudu da `privileged: true`. Duba `docker-compose.yml` a cikin repo nan da nan: idan ya hau `-`, `$HOME`, ko `/Users`, kula da kwamfutar tafi-da-gidanka mai masaukin baki kamar yadda aka daidaita.

Ta yaya cak ɗin zai zama karya idan "Cashier's Check" ne wanda FedEx ya kawo a cikin dare tare da alamar ruwa kuma ma'aikacin banki ya karɓe shi a kan kanti?¶

Ana buga cak ɗin kuɗi na jabu akan haƙƙin sinadari na gaske ta amfani da ingantacciyar lambar tuƙi da maganadisu `MICR` font tawada na babban banki. Ma'aikacin banki na ɗan adam a taga reshe yana tabbatar da cewa lambar hanyar tana aiki kuma cak ɗin ya yi kama da na zahiri; mai biyan kuɗi ba zai iya gani a cikin littafin ajiyar banki na wani ba don sanin ko an bayar da wannan lambar tambarin da gaske. Sai kawai lokacin da hoton duban ya bi ta cikin gidan ajiya na Tarayyar Tarayya (`5 to 10 business days later`) shin bankin da ya fitar ya ki amincewa da shi a matsayin jabu.

Zan iya shiga gidan yari idan na ajiye takardar shaidar aikin bogi ba tare da sani ba kuma na kashe wasu kudaden kafin ta billa?¶

Yin yaudara ta hanyar zamba ta duba aikin ba shi da niyyar aikata laifi (`mens rea`), muddin ba ka yi wa banki karya ba kuma ka kai rahoton badakalar ga Sashen Zamba na bankin da ‘yan sanda (`IC3` / rahoton 'yan sanda na gida) nan da nan. Koyaya, a ƙarƙashin Yarjejeniyar Asusu na Deposit na bankin ku da ** Code Commercial Uniform (.`UCC § 4-207 / § 4-214`**, ma'abucin asusun da ya amince kuma ya ajiye cak yana da alhaki kuma na kwangilar biyan bashin kashi 100 na duk wani ma'auni mara kyau idan cakin da aka ajiye ya dawo ba a biya ba.

Me yasa mai daukar ma'aikata ya gudanar da ainihin kiran bidiyo na mintuna 30 tare da ni akan Zoom/Google Meet idan sun kasance masu kutse na Li'azaru na Koriya ta Arewa?¶

DPRK**`Contagious Interview` (`UNC4899` / `Famous Chollima`** Masu aiki suna ɗaukar ƙwararrun masu magana da Ingilishi don gudanar da gamsarwa na mintuna 20 zuwa 45 na tantancewar HR akan Zoom, Google Meet, ko Calendly. Domin sau da yawa wurin aikin haɓaka guda ɗaya yana riƙe `$50,000 to $2,000,000+` a cikin maɓallan ƙa'idar DeFi, samun dama ga ma'ajin taswira, ko bayanan samar da girgije na kamfanoni, kashe mintuna 30 akan kiran bidiyo kai tsaye don shawo kan ku don gudu. `npm install` a kan su kima repo yana da babban koma baya a kan zuba jari ga barazana actor.

Me zai faru idan "mai aiki" ya aika kuɗi zuwa asusun banki ta ta hanyar ACH/Zelle kuma ya tambaye ni in cire kuɗi ko saya Bitcoin don aikawa ga abokin ciniki?¶

Wannan shine *Alfadarin Kudi`Layering`*** aiki. Ba kamar takaddun takarda ba (wanda ke bounces kafin daidaitawa), idan `$4,000` a zahiri ya shigo cikin asusunku ta hanyar `ACH`, `Zelle`, ko `Wire`,** haka `$4,000` an sace shi daga asusun banki mara laifi ko hacking na soyayya. Idan ka janye shi ko canza shi zuwa Bitcoin don "mai aiki," jami'an tsaro da bankin wanda aka azabtar suna gano kudaden da aka sace kai tsaye zuwa asusun bankin ku. Kada ku janye ko tura ko sisi ɗaya; kira Sashen Zamba na bankin ku nan da nan kuma ku neme su su mayar da canja wurin mara izini zuwa cibiyar da ta samo asali.

Jagora masu alaƙa¶

• Aikin karya yana ba da zamba, bincika kayan aiki, da satar shaidar shiga cikin jirgi
• Sarkar saƙon npm/PyPI daidaitawa da jujjuyawar maɓalli na wurin aiki
• Satar kuki na zama, ɓarna malware, da soke maɓallin wucewa
• Karya CAPTCHA ClickFix PowerShell 'Win+R' allo allo malware da Lumma Infostealer gyara
• Magudanar walat ɗin Cryptocurrency da jumlolin jimlar iri
• Izinin biyan kuɗin turawa (APP) zamba: Zelle, Venmo, da Biyan Biyan Sauri da haƙƙin biyan kuɗi
• Amsar satar shaida
• Lambobin gaggawa ta ƙasa

Tushen da jagorar hukuma¶

• Ofishin Bincike na Tarayya (FBI), Tsaron Intanet da Tsaron Kayayyakin Kayayyaki (CISA), & DoD Cyber Crime Center (DC3) (Amurka): Shawarwari ta Haɗin gwiwa: Koriya ta Arewa (DPRK) Kamfen ɗin Injiniya na Zamantakewa Masu Haɓaka SoftwareContagious Interview / BeaverTail / InvisibleFerret).
• Rukunin Hanyoyin Sadarwar Palo Alto 42 (unit42.paloaltonetworks.com): Yan wasan kwaikwayo na Barazana na Koriya ta Arewa Lallaba Masu Neman Ayyuka na Tech a matsayin Masu daukar Ma'aikata na Karya (Contagious Interview Nazari).
• Hukumar Kasuwanci ta Tarayya (FTC& Hukumar Reserve ta Tarayya (Amurka): Shawarwari na masu amfani da su akan zamba na duban karya, da alfadarai, da Regulation CC (12 CFR Part 229) Dokoki.
• Ma'aikatar Shige da Fice ta Amurka (USCIS::myE-Verify Jagorar Kariyar Kariyar Kulle Kai.
• Cibiyar Tsaro ta Cyber ​​(National Cyber Security Center)NCSC) & Zamba (United Kingdom): * Rage Ma'ajiya na Malicious Code da zamba na daukar ma'aikata*.