Njuumteg liggéey ak janoo ci fu sori: Lazarus bu Kore bu bëtu gannaar BeaverTail npm Repo Malware, saytu jumtukaay yu baaxul, ak tëjug dàntite¶

Xam ci diggu ab janoo liggéey bu sori wala ab doxalinu onboarding ni "recruteur" wala "hiring manager" dafay doxal benn fiir bu xarañ ci wàllu siber wala xaalis, mën na nekk jafe-jafe bu am ñaari kanam. Tay, liggéey yu sori yi ñuy naxaate dañu xaajaloo ci ñaari liggéey yu yàq lool yu FBI, CISA, ak agence cyber yu mag yi xamme: (1) Developpeur logiciel ak Crypto "Coding Assessment" Malware (Contagious Interview / RPDC Groupe Lazarus BeaverTail & InvisibleFerret), fu ab recruteur ci LinkedIn, Upwork, wala Telegram laaj ab ingenieur u losisel wala ab kàndidaa Web3 / AI ngir klone ab dencukaay GitHub, GitLab, wala Bitbucket te doxal npm install && npm start (wala tabax Python/Docker) ci seen ordinatëru portable bu njëkk ngir "defar benn bug balaa janoo bi ci saasi," di def ci ab sàcc xibaar buy segg bépp kuki sesioŋ navigateur, vault manager baatu-jàll, .ssh caabi, .env fichier, ak portefeuille cryptocurrency ci diir bu néew 5 seconde; ak (2) Fake Check "Ekipmaa yu Biro ci Kër" ak Reshipping Mule Scams, fu benn kompiñi buy naxaate di amal ab janoo ak Teams, di yónnee ay imeel yu baaxul $2,500 to $5,000 xoolal "MacBook Pro ak tabb biro ci kër," ba noppi digal la nga dugal xëk bi ci sa telefon te nga yónnee ko $2,200 jaaraleko ci Zelle, Venmo, wire, wala kàrt kado ci seen "jaaykatu ekipmaa IT buñ nangu" balaa chèque bi di rebond ay fan ci ginnaaw. Ngir dugg ci SSN/I-9 sàcc dàntite ak njuuj njaaj ci xëyma, xoolal njuuj njaaj ci joxe liggéey, njuuj njaaj ci saytu jumtukaay, ak sàcc dàntite onboarding; ngir npm/PyPI wëlbatiku caabi ak sàcc kukiis nawigatër, xoolal kompromis bu npm/PyPI ak defarkat yi ak jàpp kuki sesioŋ, loraange infostealer, ak dindi caabi jàll. Sudee danga am luñu lay sonal ci saasi, wala ñu lay tiital, wala ñu la yóbbu ci sa bopp, woo sa nimero urgence bi la gëna jege (911 ci Etats Unis ak Canada, 112 ci biir Mbootaayu Orop, 999 ci Royaume-Uni) wala nga xool sunu limu nimero paj mu jamp.

Defal lii leegi¶

1. SUDE DAA npm install, npm test, yarn, pip install, wala Zoom/Ekip/Miro bu baaxul .dmg/.exe ngir am interview liggéey: DAGGAL SA ORDINATËR CI WI-FI AK ETHERNET CI 3 SECOND:
2. Dindil fiil Ethernet bi wala nga OFF Wi-Fi ci saasi.
3. BeaverTail JavaScript/Node.js dafay yebbi ab environmaa Python buñu mëna yóbbu (-/.npl wala %UserProfile%\.pyp) ak ubbi InvisibleFerret backdoor, biy boole komand-ak-kontrol (C2) serwër (:1224 / :1244) di streaming say tombi tombi, clipboard ak sistem fichier ci saasi.
4. Jëfandikool ab telefon bu wuute te set (iPhone wala Android ci done selulaar) ngir dindi bépp portefeuille cryptocurrency ak dindi bépp sesioŋ navigateur buy dox (Google, GitHub, AWS, Microsoft, Apple):
5. BeaverTail Metamask, Fantom, Rabby, Portefeuille Coinbase, Portefeuille de confiance, Exodus, Electrum, et Solana CLI (-/.config/solana/id.json) fichier vault, ak Login Data ak Cookies ci Chrome, Brave, Edge, Arc, ak Firefox, boole ci sa macOS login.keychain-db.
6. Ci benn aparey bu sell, toxal bépp alal crypto ci portefeuille yu tàng yi ci jiwwu portefeylu hardware bu bees, dindi bépp sesioŋ web buy dox ci Google (myaccount.google.com/security), GitHub (github.com/settings/sessions), ak konsol AWS/Cloud, nga efaase say caabi SSH ak GPG yuñ laal ci GitHub/GitLab.
7. SUDEE DEFAY SËKK CI BENN LIGGÉEYU CI BENN BENN DOLLAR CI BENN "JAAYKAT," TE WOO CI SAASI BÀNK BI CI NJÀNGALE CI BÀNK:
8. Doonte sa aplikaasioŋu bànk dafay wane $3,500 xoolal "Saldo bi jàppandi / Xaalis biñ génne," xaalis boobu Fàccewul. Ci wàllu Reserve Federal bu Etats Unis Reglement CC (Expedited Funds Availability Act), bànk yi dañu wara def ay deposit ci xëk ci diir bu gàtt 1 to 2 business days, fekk ñu gis ni nimero routing/kontu chèque bi dañu ko naxaate 5 to 14 business days.
9. Woowal nimero bi ci ginaaw sa kàrt debit nga yëgal ko: "Dañu ma nax ci chèque liggéey, te xamuma ni def naa chèque bu baaxul; nanga def siñaal deposit bi suko defee ñu baña tëj sama kontu ndax njuuj njaaj."
10. Sudee YONNE NGA ZELLE, VENMO, WIRE, WALA BITCOIN ATM FONDS CI "JAAYKAT EKIPEMENT": Woowal ci saasi biro Fraud / Wire Recall ci sa bànk (ngir kable, laajal ci saasi SWIFT / Fedwire Recall ak FBI IC3 Recovery Asset Team gelé; ngir Zelle/Fay yu gëna gaaw, yëgal ab Fay Push buñu may (APP) scam de impersonation de l'emploi ci suufu njuuj njaaj ak yelleefu delloo xaalis).
11. SUDEE YËGGAL SA SSN, PASPOOR, PERMI DAWAL, W-4, I-9, WALA NIMÉRO ROUT BANQUE DIREKT: Defal benn congelasioŋ ci Equifax, Experian, ak TransUnion, congelal sa Soolmyeverify.uscis.gov), nga wax sa bànk mu tëj nimero kontu bi nga xool, nga ubbi beneen nimero kontu.
12. SUDE NANGU NGA "SÀMTU KOLI / COORDINATEUR LOGISTIQUE" LIGGÉEY JOX AK YONNEE KOLI CI KËR: TAXAW YONNE KOLI YI CI SAASI: Yooyu aparey elektronik (iPhones, MacBooks, camera lenses) jëndoon nañu ko ak kàrtu kredi buñ sàcc ba noppi yónnee ko sa adres kër (Parcel Mule Scam). Def bépp etiketu yobbu ak këyitu waxtaan yi nga jokkool ak poliisu dëkk bi wala Serwiisu saytu postu Etats Unis (USPIS).

Garab dogal: janoo ci fu sori ak tànneef liggéey bu jamp¶

Jëfandikool diagram bii ngir dem ci protokolu tëye bi méngoo ak xeetu liggéey bi nga dajeel:

flowchart TD
    Start["Jafe-jafe: Dañu yaakaar ni dañu def ay janoo ci liggéey, Test ci kodage, wala ñuy naxaate ci Onboarding"] --> ScamType{"Lan la 'Recruteur' wala 'Employer' laaj nga def?"}

    ScamType -->|"1. Klone ab Git Repo & Doxal npm / Python / Docker WALA nga samp ab aplikaasioŋ woote wideo"| DevTrap["BU AM SOLO: RPDC waxtaan buy joxe jàngoro (BeaverTail / Ferret buñudul gis) Sàcckat xibaar"]

    ScamType -->|"2. Def ab chèque (PDF/Mail) & yónnee xaalis 'Jaaykatu jumtukaay buñu nangu'"| CheckTrap["Njuumteg sëkk buy fay lu ëpp: sëkk buñ def ci ab diir dina dellu ci 5 ba 14 fan"]

    ScamType -->|"3. Bindal I-9 / W-4 / SSN / Passport / Formulaire deposit direct balaa ngay gis ni dañu la nax"| IdTrap["dàntite biy dugg ci gaal gi ak sàcc saleer: Leble buy gelé, ChexSystems, PIN IP IRS, ak kontu bànk"]

    ScamType -->|"4. Jot kofre ci sa kër, xool leen, & yónneewaat ak etiketu joxe WALA fay 'Liggéey' Crypto"| MuleOrTask["Yobbuwaat kofre Mule WALA 'Optimisation App' Crypto Task Scam"]

    DevTrap --> CutNet["1. Fatt Wi-Fi / Debrancher Ethernet ci saasi ci liggéeyukaay Developer"]
    CutNet --> EvacPhone["2. Ci Telefoŋ bu Sell: Toxal Crypto Asset + Bayi Google / GitHub / AWS sesioŋ + wëlbati SSH Keys"]
    EvacPhone -->ForensicClean["3. Saytu OS bi"]

    CheckTrap --> SentMoney{"Ndax yónnee nga xaalis 'Jaaykatu jumtukaay yi'?"}
    SentMoney -->|"Deet: Dañu dugal xëk, $0 dañu ko yónnee"| WarnBank["BU LEEN LAAL xaalis bi -> Woowal Dept Fraud Bank ci saasi ngir xamle Deposit Check bu baaxul"]
    SentMoney -->|"Waaw: Yonnee ci Zelle / Fiil / Crypto / Kartu kado"| RecallFunds["Woowal bànk bi ci saasi -> muur débit bu baaxul balaa xëkk bi di rebond -> dosie IC3 rapoor"]

    IdTrap --> LockCredit["-> tëj nimero kontu bànkeer biñ wane -> tëj sama E-Xam"]
    MuleOrTask --> StopShip["Taxawal Yobbuwaat Koli & Taxawal Def Crypto -> Moytu Waybills & Rapport ci USPIS / IC3"]

Faas 1: Ni ñaari fiir yu mag yi di doxee ci suufu kapot bi¶

Teg leen mekanik teknik yi ak màndarga xonk yi ci ñatti vecteur yu njëkk yi ci wàllu liggéey yu jamp yi am ci àdduna bi yépp:

2ème étape: Tontu ci jafe-jafe ngir defarkati losisel yi (Contagious Interview / BeaverTail / InvisibleFerret)¶

Sudee defarkatu losisel nga, nga klone ab dencukaay ci ab recruteur wala interviewer ba noppi daw npm install, npm start, yarn, pnpm, python, cargo, wala benn executable ci sa Windows, macOS, wala Linux, toppal lii di tontu ci jafe-jafe yi lalu ci Palo Alto Reseau Unit 42, CrowdStrike, ak CISA/FBI xam-xam buy tiital Kore bu bëtu gannaar Contagious Interview kampaañ.

Jéego 1: Xam 2-Jéego yi BeaverTail -> InvisibleFerret Ray Chain ci sa disk¶

Naka la dencukaay React/Node.js bu nuru lu jaadu mëna jàpp sa Mac wala PC te du génne benn popup antivirus?

+-------------------------------------------------------------------------+
| ANATOMY OF A CONTAGIOUS INTERVIEW (BEAVERTAIL) MALICIOUS REPO           |
|                                                                         |
| 1. The Decoy Repo (e.g., "mern-ecommerce-assessment" or "defi-dex-ui"): |
|    - 99% of the repo is real, working React/Express boilerplate code.   |
|    - Hidden at the very end of `server/routes/api/auth.js` or           |
|      `backend/controllers/userController.js` (often scrolled 300 spaces |
|      to the right on one line so you do not see it in VS Code) is an    |
|      obfuscated `eval(Buffer.from(...))` or `axios.get(...)` call.      |
|                                                                         |
| 2. Stage 1: BeaverTail (JavaScript Info-Stealer inside Node.js):        |
|    - Scans Chrome, Brave, Opera, Edge, Vivaldi (`Default` & `Profile N`)|
|      for `Login Data`, `Local Extension Settings` (MetaMask `nkbihfbeog`|
|      Phantom `bfnaelmome`, Rabby `acmacodkjb`), and Solana `id.json`.   |
|    - Uploads stolen vaults & cookies immediately to `http://<C2>:1224`. |
|                                                                         |
| 3. Stage 2: InvisibleFerret (Python Backdoor + AnyDesk Persistence):    |
|    - BeaverTail downloads a standalone portable Python 3.11 zip into    |
|      `~/.npl/` or `%UserProfile%\.pyp\` and runs `~/.npl/.pyp/python`   |
|      executing `~/.npl/main.py` (`InvisibleFerret`).                    |
|    - InvisibleFerret logs keystrokes, reads your clipboard, scans your  |
|      entire drive for `.env`, `.ssh`, `seed`, `mnemonic`, and silently  |
|      downloads/configures `AnyDesk` for full remote desktop control.    |
+-------------------------------------------------------------------------+

Xool bu baax BeaverTail ak InvisibleFerret Màndarga yiy wane déggoo (IoCs)¶

Bi sa ordinatër Mac, Linux wala Windows bi feebar bi jàpp nekkul ci Wi-Fi ak Ethernet, ubbil benn terminal (wala PowerShell) ngir xool ndax 2e étape (InvisibleFerret) dafa wàcci ci sa disk:

# On macOS or Linux (WITH WI-FI OFF):
ls -la ~/.npl ~/.pyp ~/.vscode
ps aux | grep -iE "npl|pyp|main\.py|anydesk|node"

# Search the cloned interview repository for hidden horizontal-scroll obfuscation or base64 evals:
grep -rnE "Buffer\.from|child_process|execSync|\.npl|\.pyp|:1224|:1244|nkbihfbeogaeaoehlefnkodbefgpgknn" /path/to/cloned/interview_repo/

# On Windows PowerShell (WITH WI-FI / ETHERNET OFF):
Get-ChildItem -Path $env:USERPROFILE -Force | Where-Object { $_.Name -match "^\.(npl|pyp)" }
Get-Process | Where-Object { $_.Path -match "npl|pyp|AnyDesk" }

Jéego 3: Defal 15-Simili Developer Credential & Crypto Evacuation (Ci ab aparey bu sell)¶

Bul bind baatu-jàll bu bees wala mbind yu bees ci ordinatër bi feebar bi jàpp. Jëfandikoo ab telefon bu set (iPhone / Android) wala ordinatër bu wuute te kenn duko yàq**:

1. ** Rawal bépp portefeylu Cryptocurrency ci saasi (Minutes 0 to 5)**:
2. Doonte sa MetaMask, Phantom, Rabby, wala portefeuille Exodus dañu ko tëjoon ak baatu-jàll, BeaverTail yebbi sa fichier coffre encrypté (000003.log / LOCK / Local Extension Settings) ak InvisibleFerret dafay doxal ab monitëru keylogger/clipboard (ak ci macOS dafay jameet ab native bu baaxul osascript baatu-jàll dialog laaj sa baatu-jàll sistem Mac ngir tijji login.keychain-db).
3. Sosal ab portefeuille bu bees ci sa ** telefon bu xarañ wala portefeylu hardware (Ledger / Trezor) ** ak ** 12/24-word seed phrase ** te nga toxal 100 pursaa ci say jeton, NFTs, ak position staking ci bépp portefeylu bu musa laal ordinatër boobu.
4. Bayi bépp GitHub, GitLab, Bitbucket ak Niir (AWS / GCP / Azure / Vercel) santaane (Minutes 5 to 10):
5. GitHub: Duggal ci sa telefon -> Jekkal -> Caabi SSH ak GPG -> Fàcce bépp caabi SSH buñ denc ci -/.ssh/ ci ordinatër portable bi feebar bi jàpp. Ginaaw loolu nga dem ci Jekkal -> Jekkal defarkat -> Jetons jëfandikoo sa bopp (bayi jeton yépp) ak Jekkal -> Sesioŋ yi -> Bayi sesioŋ yépp.
6. AWS/GCP/Niir: Def ci saasi bépp AWS_ACCESS_KEY_ID denc ci -/.aws/credentials wala ci biir benn .env fichier ci portable bi (InvisibleFerret dafay xool ci anam wu baax bépp dosiye projet bu nekk ci sa disk ngir .env, .npmrc, .pypirc, kubeconfig, ak id_rsa).
7. Sudee am nga dencukaay/caabi sa patroŋ wala kiliyaan ci ordinatër portatif bi: Yegal sa patroŋ Centre Operations de Sécurité (SOC / CISO) ci saasi ngir ñu mëna wëlbati liggéeyukaay .env sekkere ak def audit.
8. Bayi bépp sesioŋ Navigateur (Google, Microsoft, Apple, Slack, Discord, Telegram) (Minutes 10 to 15):
9. Nga bàyyi sa xel ni: soppi baatu-jàll du dindi kuki sesioŋ yuñ sàcc fileek bësal "Génn ci bépp aparey / Bayyi bépp sesioŋ" ci Kaaraange Google, Kontu Microsoft, Slack, Discord, ak X/Twitter.
10. Soppi sa Njiitu baatu-jàll (1Password, Bitwarden, Keeper) baatu-jàll master bi nga dindi token aparey bi ordinatër portable biñ jox feebar bi.
11. Fomp te sampwaat sistem bi ci station bi feebar bi jàpp: Ndax InvisibleFerret dafay samp ay liggéey yu yàgg ci ginaaw, soppali binaire navigateur, ak dindi AnyDesk jëfandikoo ci fu sori, efaase rek -/.npl ak dencukaay biñ klone doyul. Sauvegarde dokimaa/dosiye source rek (ñu xool ko sell ak git status / git diff), ba noppi nga efaase OS bi ba noppi nga sampaat ko (macOS Erase All Content and Settings wala Windows USB fomp xaaj bu sell).

3ème étape: Tontu ci jamonoy jafe-jafe ngir njuuj njaaj "Ekipmaayu biro ci kër"¶

Sudee dañu la jox liggéey ci fu sori (Administrative Assistant, Data Entry, Customer Support, Project Coordinator, Graphic Designer), jot nga chèque (jaaraleko ci imeel PDF ngir imprime ak deposit mobile, wala jaaraleko ci FedEx / UPS enveloppe guddi) ngir jënd ordinatër portatif ak jumtukaayi biro ci kër, nga dugal ko ci sa kontu bànkeer, yaa ngi ci kursu ak ** Reserve Federal xëk buy dindi palanteer delloo **.

1. Lu tax app bànk bi wax "Fonds disponible" ci 100% xëk bu baaxul (The Regulation CC Float Trap)¶

+-------------------------------------------------------------------------+
| HOW THE FAKE "EQUIPMENT CHECK" FLOAT TRAP WORKS                         |
|                                                                         |
| Day 1 (Monday): You deposit the scammer's $3,500 "Equipment Check"      |
|                 using your bank's Mobile Deposit app.                   |
| Day 2 (Tuesday): Under US Federal Law (Regulation CC), your bank MUST   |
|                  release the funds within 1-2 business days. Your app   |
|                  now shows: "Available Balance: +$3,500.00".            |
| Day 2 (Tuesday PM): "Hiring Manager" tells you to Zelle/Wire $2,800     |
|                     immediately to their "Approved MacBook Vendor" so   |
|                     your laptop arrives by Friday.                      |
| Day 8 (Next Tuesday): The real corporate bank whose routing/account     |
|                       number was forged on the check rejects it as      |
|                       COUNTERFEIT / ALTERED (`Return Code R29 / Refer   |
|                       to Maker`).                                       |
| RESULT ON DAY 8:                                                        |
|   - Your bank claws back the full $3,500.00 from your balance.          |
|   - The $2,800 you sent via Zelle/Wire is gone forever.                 |
|   - Your account drops to -$2,800.00 overdraft, and your bank's risk    |
|     algorithm may freeze/close your account and report you to           |
|     ChexSystems as a check-fraud risk.                                  |
+-------------------------------------------------------------------------+

2. Protokolu aaru bànk bi jéego ci jéego sudee danga dugal xëk bi¶

Case A: Def nga chèque bi waaye yónneegoo xaalis "jaaykat bi"¶

Danga ñàkk $0 ba leegi, te mën nga tere sa bànk tëj sa kontu sudee danga def dara leegi: 1. BULEEN genne, jëfandikoo wala toxal benn cent ci xaalis biñ def ci chèque bi. Bàyyil lépp $3,500 toog te kenn laalu ko ci kontu bi, suko defee su chèque bi delloo ci 5 ba 10 fani liggéey, bànk bi dafay jëlaat leble bimu yor ci anam wu sell ak $0 débit 2. Woowal ci saasi Departemaa bi yor njuuj njaaj ci sa bànk (wala nga dugg ci bànk bi nga waxtaan ak kilifag bànk bi): - Sudee xëkk bu baaxul bi dafay rebondir ci ab tekkaaral te kenn xamul lumuy tekki, motëri risk bànk yi otomatik (Early Warning Services / ChexSystems) mënul wax ndax yaay nax wala danga doon wër liggéey te dara waralu ko. - Wax leen ndawu bànk bi ci anam wu leer: "Dama laaj liggéey ci fu sori, te scammer bi yonne nama '$3,500' chèque ekipmaa bi ma def ci sama mobile tay. Dama mujjee gis ni scèque liggéey bu baaxul la. Jëfandikouma wala toxal benn dolaar ci xaalis bi. delloosi/ tëye leble bi fi yàgg ngir ñu baña daan sama kontu su chèque bi delloo te feyu ñu ko." - Laaj bànk bi mu baale $15 to $35 Dellool fere yiñ def ci mbir mi te firndeel ni duñu màndargaal sa kontu ngir tëj ko.

Case B: Yaa ngi def chèque bi ba noppi yónnee nga xaalis (Zelle, Venmo, Wire, Cash App, Crypto, wala Gift Cards)¶

1. Woowal sa bànk bi yor njuuj njaaj ci diir bu weesuwul 60 seconde:
2. Raporteel ñaari pàcc yi ci krim bi: (a) xëk biy dugg, xëk buy naxaate ci liggéey la, te (b) Zelle / Venmo / Wire / ACH biy dem, dafa juddoo ci njuuj njaaj ci liggéey.
3. Soo yonne ab kable bànk (Fedwire / SWIFT) ci diiru 24 ba 72 waxtu yu mujj yi: Laajte ci saasi Recall wire bu njuuj njaaj (SWIFT MT192 / pacs.004) nga def rapoor ci gaaw ci ic3.gov Kon FBI's Ekipu Recuperation Asset (RAT) mën na joxe ab chaîne buy ray njuuj njaaj ci xaalis (FFKC) congélé ci kontu mule biy jot.
4. Soo yónnee Zelle, Venmo, wala UK Faster Payments: Def ab Fay Push buñu may (APP) ñaxtu njuuj njaaj ak laaj leeral ci yoonu bànk biy jot/institution bi (Zelle Network Fraud).
5. Sudee ki lay nax daf la wax nga jënd kàrt kado Apple, Razer Gold, Steam, wala Target: Woowal ci saasi liiñ biy naxaate ci kàrt kado bi nga joxe ko nimero serie resit bi ngir dindi bépp saldo bu des ci kàrt bi te doo jëfandikoo.
6. **Waajal $3,500 xoolal clawback ngir sa kontu baña dem ci ChexSystems sargal **:
7. Bi fake $3,500 ba 10 fan, sa bànk dina ko dagg $3,500 ci sa kontu. Liggéey ak ekipu bànk biy xeex njuuj njaaj ngir defar ab pexe ngir fay bépp saldo bu baax balaa bis 30 suko defee bànk bi du yëgal ChexSystems wala Serwiisu Teela Àrtu (EWS).

4ème étape: Tëj sa dàntite sudee joxe nga I-9, W-4, SSN, Passport, wala formileeru deposit direct¶

Recruteur yu baaxul yi dañuy faral di yónnee "Paquet Onboarding" (Form W-4, Form I-9, Direct Deposit Authorization, ak nataali kanam ak ginaaw sa permi dawal, sa paspoor, wala sa kàrtu kaaraange sosiaal) balaa ngay jël xëcc bi wala fiiru xeetu loraange bi. Soo yonne benn ci këyit yooyu, defal 5 jéego yii di tëju dàntite tay:

1. Tëj nimero kontu bànkeer biñ wane (Direct Deposit formileer): Formileeru deposit direct dafay jox scammer bi sa Nimero Routing Bànk (ABA) ak nimero kontu xool bu mat sëkk, boole ci benn kopi xëk bu baaxul ak sa anamu siife, muy lépp loo soxla ngir imprime xëk bu baaxul ci këyit wala ngir tàmbali xëk buñu nanguwul ACH Debit génne ci sa kontu. Wax sa bànk mu tëj nimero kontu boobu nga toxal sa xaalis ci nimero kontu bu bees.
2. Defal benn Congelasioŋ Leble ci ñatti biro leble yi:
3. Ekifaks (equifax.com/personal/credit-report-services/credit-freeze/ / 1-888-298-0045)
4. Jàngat (experian.com/freeze/ / 1-888-397-3742)
5. Trans Union (transunion.com/credit-freeze / 1-800-916-8800)
6. Gel ChexSystems (chexsystems.com) ak NCTUE: Bànk yi dañuy jëfandikoo ChexSystems (du Equifax/Experian) su amee ku ubbi kontu xaalis ci sa tur. Defal ab ChexSystems Security Freeze ci net bi te doo fay, suko defee naxaatekat yi duñu mëna ubbi kontu bànkeer yu jëfandikoo sa permi dawal biñ sàcc ak sa këyit I-9.
7. Tëj sa nimero Sécurité Sociale myE-Verify (USCIS: Demal ci myeverify.uscis.gov ak aktive Self Lock, luy tere ku nekk jëfandikoo sa SSN ci sistemu liggéey bu E-Verify federal.
8. Am IRS Identity Protection PIN (IP PIN) (irs.gov/ippin): Moytul naxasaalekat yi def ay delloosi juuti yu baaxul ci sa tur soo binndee ci saasi benn IRS IP PIN bu am 6 araf.

5ème étape: Dakkal benn "Mule buy Yobbuwaat Colis" wala "Crypto Task" Scam ci anam wu wóor¶

Ak sudee dañu la jël ci benn ci ñaari naxasaale yii di liggéey ci fu sori te duñu la saytu?

Scenario 1: Nangu nga liggéeyu "Kontrol Kalite / Yonnee koli" te am nga koli ci sa kër¶

Sudee jot nga MacBook, iPhone, wala aparey elektronik ci sa adres kër ba noppi ñu jox la USPS/UPS/FedEx etiketu yobbu PDF ngir yónnee leen: - TAXAL yobbu koli yi ci saasi. Bépp kofre buy yegsi sa kër dañu ko jëndoon ci kàrtu kredi buñ sàcc, foofu la naxaatekat bi dugal sa tur ak sa adres kër ni Ship To adres. - BULEEN delloosi koli yi ci adresu scammer bi: Denc boyet yi ubbeekuwul, denc bépp email, waxtaan Telegram, etiketu yobbu PDF, ak kontraa liggéey ngir firnde, te jokkool ak poliisu dëkk bi ak U.S. Serwiisu saytu postaal (1-877-876-2455 / uspis.gov) (wala Action Fraud ci UK) ngir delloosi mbir yi jaaykat detaay yiñ nax.

Senaario 2: Dañu la jëlee ci WhatsApp/Telegram ngir ab "Njëfandikoo App / Njëg Produit" Liggéeyu Crypto¶

• Ni fiir bi di doxee: "Patroŋ bi" moo lay fay $50 to $150 ci dëgg USDT ci bis bu njëkk bi ndax klike ci butoŋu portaalu web bu baaxul. Ci ñaareelu bis bi wala ñatteelu bis bi, sa kontu dafay jot "Liggéey buñ boole" buy def sa saldo portaal ci -$400 te dafay laaj nga def xaalis $400 sa bopp USDT ngir "matal 40 liggéey yi." Saa yoo defee xaalis $400, ñaareelu liggéey bi dafay laaj $1,800, léegi nak $6,000, léegi nak $25,000 ngir "juuti."
• Jëf ci saasi: TAXAW dugal cryptocurrency ci saasi. Nimero yi sitweb liggéey bi ay valeur HTML yu baaxul lañu yu scammer bi di saytu; Feye saldo negatif du musa ubbi ab dindi xaalis. Dagg bépp jokkool te moytu "pirate yu defaraat kripto" ci Telegram wala Instagram.

Nimero paj mu jamp ak protokolu agence¶

Raporte malware interview ci fu sori (Contagious Interview), njuuj njaaj ci saytu liggéey, ak sàcc dàntite onboarding ci kilifay siber ak xaalis ci sa gox:

• Etats Unis ak Canada: Bësal 911 ngir bépp jafe-jafe kaaraange yaram. Raporte xeetu loraange bu defarkat bi (Lazarus / BeaverTail) ak njuuj njaaj ci saytu liggéey / ñàkk liggéey ci FBI IC3 (ic3.gov), FTC (ReportFraud.ftc.gov ak IdentityTheft.gov), ak USPIS (1-877-876-2455). Soo nekkee Canada, jokkool ak Centre buy xeex njuuj njaaj ci Canada (1-888-495-8501) ak Santar bu Canada ngir Kaaraange Siber (1-833-CYBER-88).
• Royaume-Uni: Dial 999 ngir jafe-jafe yi wala 101 ngir poliisu dëkk bi. Dial 159 ngir lëkkaloo ak bànxaasu njuuj njaaj ci sa bànk, nga yëgal njuuj njaaj yi ak xeetu loraange yu baaxul yi ci Action Fraud (0300 123 2040 / actionfraud.police.uk) ak NCSC (ncsc.gov.uk). Xalaatal Bindu Aar CIFAS (cifas.org.uk).
• Mbootaayu Ëroop: Dial 112 ci bépp réew bu bokk ci EU, yëgal sa bànk bi yor njuuj njaaj ci saasi, nga joxe rapoor ci sa poliisu nasonaal buy saytu krim ci net bi ak CSIRT nasonaal.
• Ostralie ak Nouvelle-Zélande: Dial 000 ci Australie wala 111 ci Nouvelle-Zélande. Delloosi Scamwatch (scamwatch.gov.au), RapportSiber (cyber.gov.au, 1300 CYBER1), nga jokkool ak IDCARE (1800 595 160 ci AU / 0800 121 068 ci NZ).
• Inde ak Asie-Pacifique: Bësal 112 ci Inde ngir jafe-jafe yi nga woo Liñuy jàppale ci krim siber (1930 / cybercrime.gov.in) ci saasi ngir dakkal xaalis biy juum ci bànk. Soo nekkee Singapore, woo Liñuy jàppale ci wàllu nax (1799).

Laaj yi ñuy faral di laaj¶

Dama klone dencukaay GitHub biy jël nit ñi (git clone ...), ubbi fichier yi ci VS Code ngir jàng leen, te MUSUL daw npm install wala npm start. Ndax ba leegi feebar bi jàpp naa ko?¶

wuute ak `npm install` (muy daw `package.json` scripts), di daw `git clone` ak jàng lu leer `.js` fichier yi duñu def kode ci seen bopp fileek dencukaay bi defa am luy lore `.vscode/tasks.json` fichier ak `"runOn": "folderOpen"` Ak nga bës "Waaw, wóolu naa bindkat yi" bi VS Code ubbee dosiye bi. Saytu ndax `.vscode/tasks.json` fichier bi nekk ci biir repo biñ klone (`cat /path/to/repo/.vscode/tasks.json`) nga xool ndax `-/.npl` wala `-/.pyp` ñu ngi ko sos ci sa répertoire dalal. Sudee benn ci ñoom amul te musul daw `npm`, `yarn`, `python`, wala `node`, sa sistem deful charge utilitaire bi: dangay efaase dossier biñ klone.

Ak sudee def naa test codage interview ci biir benn conteneur Docker (docker compose up) ci sama PC wala PC Windows? Ndax konteenaar bi daf ma aar?¶

Dafay aju ci volume yiñ monte ci biir `docker-compose.yml` wala `Dockerfile`. Soo doxalee konteiner bi ak sistemu fichier bu wuute, xeetu loraange bi mënul gis say kukiis Chrome wala extension MetaMask. Waaye, ñu bari `Contagious Interview` dencukaay yi dañu am `docker-compose.yml` di boole ci nëbbëtu sa répertoire home host (`volumes: - -/.ssh:/root/.ssh` wala `- -/:/host_home`) wala daw ak `privileged: true`. Saytu `docker-compose.yml` ci repo bi ci saasi: sudee dafa yéeg `-`, `$HOME`, wala `/Users`, defal sa ordinatër portable ni dafa am jafe-jafe.

Nan lay mëna doon xëk bu baaxul sudee "Sëkk bu xaalis" la bu FedEx Overnight indi ci guddi gi ak filigran te ki yor bànk bi nangu ko ci kontuwaar bi?¶

Chèque caisseur yu baaxul yi dañu leen di imprime ci stock chèque chimik yu baax yi, ñu jëfandikoo nimero routing bi baax ak magnetik `MICR` ink font bu benn bànk bu mag. Nit ku nekk ci bànk bi nekk ci palanteeru bànk bi, dafay xool ndax nimero routing bi baaxna, te chèque bi dafa baax; kassier bi mënul gis li nekk ci biir beneen bànk ngir xam ndax nimero serie chèque bi lañu joxe. Sudee nataalu sëkk bi jaar na ci këru xaalis bu Reserve Federal (`5 to 10 business days later`) ndax bànk bi ko joxe daf koy bañ ndax dafa naxasaale.

Ndax mën naa dem kaso sudee def naa xëkkatu liggéey bu baaxul te xamuma ko, ba noppi ma jëfandikoo xaalis bi balaa muy rebond?¶

Nax la ci ab naxasaale ci saytu liggéey amul benn yéene def ñaawtéef (`mens rea`), lépp bëgg nga fenul bànk bi te nga yëgal departemaa bi yor njuuj njaaj ci bànk bi ak poliis bi (`IC3` / rapooru poliisu dëkk bi) ci saasi. Waaye, ci wàllu kontraa Kontu Depositu bànk bi ak **Kodu Njaayum Benn (`UCC § 4-207 / § 4-214`)**, boroom kontu bi jël xëk ba noppi def ko, ci wàllu siwil ak kontraa, dafa wara fay bànk bi 100 pursaa ci bépp saldo bu baaxul buñu jëlee ci kontu bi, sudee xëk biñ def te kenn duko fay.

Lan moo tax kiy jël nit ñi def benn woote wideo bu 30 simili ak man ci Zoom/Google Meet sudee pirat yu Lazarus yu Kore bu bëtu gannaar lañu woon?¶

RPDC **`Contagious Interview` (`UNC4899` / `Famous Chollima`)** Operatër yi dañuy jëfandikoo nit ñu mëna làkk Àngle ngir amal ay woote yu leer ci 20 ba 45 simili ci Zoom, Google Meet, wala Calendly. Ndax benn station developpeur dafay faral di tëye `$50,000 to $2,000,000+` ci caabi protokol DeFi, jëfandikoo multisig alal, wala santaane liggéey cloud, def 30 simili ci woote wideo ngir gëmloo la nga daw `npm install` ci seen repo evaluation amna ndàmpaay bu rëy ci dugal xaalis ngir aktër menace bi.

Ak sudee "patroŋ bi" yonne xaalis ci sama kontu bànkeer jaaraleko ci ACH / Zelle ba noppi waxma ma genne xaalis wala ma jënd Bitcoin ngir yónnee seen kiliyaan?¶

Loolu mooy **Mule Xaalis (`Layering`)** liggéey. wuute na ak xëkku këyit (buy rebond balaa muy settle), sudee `$4,000` yegsi na ci sa kontu jaaraleko ci `ACH`, `Zelle`, wala `Wire`, **bi `$4,000` ñu sàcc ko ci kontu bànkeer bu ku deful dara wala kuñu nax ci mbëggeel**. Soo ko dindie wala nga soppi ko ci Bitcoin ngir sa "patroŋ," yoon wi ak bànku kiñ sàcc dañuy topp xaalis biñ sàcc ci sa kontu bànkeer. Bul dindi wala yónnee benn cent; Woowal ci saasi Departemaa bi yor njuuj njaaj ci bànk bi nga wax leen ñu dello xaalis bi nga joxe te nangu wuñu ko ci bànk bi ko jëlee.

Gid yu jëm ci loolu¶

• Njuumteg joxe liggéey, njuuj njaaj ci saytu jumtukaay, ak sàcc dàntite onboarding
• Npm/PyPI ci wàllu joxekaay ak wëlbatiku caabi station de travail developpeur
• Xañ kuki sesioŋ, loraange infostealer, ak dindi caabi jàll
• CAPTCHA bu baaxul
• Cryptocurrency portefeylu drein ak jiwwu frase kompromis
• Njuuj njaaj ci aplikaasioŋu fayukaayu push (APP): Zelle, Venmo, ak fay yu gaaw yi ñuy niru ak yelleefu delloo xaalis
• Tontu sàcc dàntite
• Nimero paj mu jamp ci réew mi

Boroom yi ak tegtali ofisel¶

• Biro federoo buy amal lànket (FBI), Kaaraange siber ak kuréelu kaaraange jumtukaay (CISA), & DoD Centre Crime Siber (DC3) (Etats Unis): Digalkat buñ boole: Kore bu nord (DPRK) Kampaañu ingenieur sosiaal yuñ jagleel defarkati losisel yi (Contagious Interview / BeaverTail / InvisibleFerret).
• Palo Alto Réseau Unité 42 (unit42.paloaltonetworks.com): Aktër yu Kore bu bëtu gannaar di nax ñiy wut liggéey ci xarala yu bees yi ni ay recruteurs yu baaxul (Contagious Interview Jàngat).
• Komisoŋu Njaayum Fédéral (FTC) & Federal Reserve Board (Etats Unis): Xelal ñiy konsome ci wàllu njuuj njaaj ci xëyma yu baaxul yi, Mule yu ñuy yónnee kofre, ak Regulation CC (12 CFR Part 229) Regle.
• Ndawu Etats Unis ak Serwiisu Immigraasioŋ (USCIS): myE-Verify Njàngale ci aar dàntite Self Lock.
• Centre national de sécurité cyber (NCSC) & Njuuj njaaj ci Jëf (Royaume-Uni): Fàññi Dencukaay Kod yu bonn yi ak Njuuj njaaj ci Recrutement.