Scam registry

• Job listings redirect to a Google form for applications
• Form links to an external credit report site

• Promotes fake job openings on various platforms
• Requests detailed CVs and personal information

• Contact made via email to a Gmail address
• Promises job opportunities with no real positions

• Initial HR call with vague details about the position
• Series of interviews and tests via external links

• Contact made via Gmail instead of official company domain
• Claims of confidentiality used to justify email choice

• No video or phone interviews, only a questionnaire
• Congratulates on a job without real interviews

• Contact via email from a suspicious recruiter address
• Text-based interview conducted through Skype

• Contact made through a fake offer letter
• Uses a fraudulent domain: aramcoindia.in

• Posts job ads on LinkedIn and other platforms
• Conducts professional meetings to build trust

• Contact made through a fake job letter from a Gmail address
• Asks for a Rs. 8,000 deposit for document verification

• Contact made via email from the95agencycareers.com
• Claims to offer a Video Editor position

• Email from info@atmosfy2.site claiming to be a recruiter
• Offers an interview via Skype text messages at odd hours

• Contact via Skype with a fake job offer
• Promises of tools and support, then communication stops

• Initial contact through WhatsApp with a fake job offer
• Claims to offer a commission-based position with daily tasks

• Initial contact through a fake job interview invitation
• Requests for personal documents and background check authorization

• Initial outreach from a recruiting specialist via email
• Requests a resume to proceed with the application

• Contacted via email by a fake HR representative
• Multiple interview rounds followed by a Letter of Confirmation

• Initial contact through a suspicious job offer email
• Interview conducted via Microsoft Teams with vague questions

• Uses a personal Gmail address instead of a company email
• Claims to be a Senior Talent Acquisition Leader at Reed

• Claims of high-paying jobs matching LinkedIn profiles
• Asks for payment for resume improvement services

• Contact via public posts or comments on LinkedIn
• Requests for CVs and personal information follow

• Screening call, then a link to a fake onboarding portal
• Asks for a $200-$300 equipment deposit, payable in crypto

• Posts fake job listings on platforms like LinkedIn
• Collects resumes for data harvesting and affiliate links

• Contacts targets through job ads or social media
• Requests personal information for application processing

Phising link.

Based on my original post on LinkedIn: https://www.linkedin.com/posts/dmitriiprusakovlinkedin-jobsearch-scam-activity-7492972814103109632-M0wH/ Post: Yesterday I almost became the target of a sophisticated "technical interview" scam. Last Friday I received a message from a guy on LinkedIn named Chris Barber. Nothing looked particularly suspicious: · A normal-looking profile. · A Frontend Engineer position with basic description. · A startup called MotorMint. · A Calendly link to schedule an interview. · The account title was HRBestPeers. Everything looked like a typical recruiting outreach. Despite that warning, I decided to join the call out of curiosity and to see whether they were still running the same operation. This time, the interviewer joined as Finn Carter (impersonated identity), kept the camera off. After a few standard HR questions, he asked me to share my screen and "inspect" a public GitHub repository. At first glance it looked like a normal project, but a few things immediately felt wrong. The repository is published under an account impersonating Ava Labs (using their branding and avatar). Previously they were impersonating MotorMint. That's already at least the third identity they've used. The interviewer wasn't interested in discussing architecture or reviewing code. He wanted me to clone the repository to "review the project" and run it on my own machine during the interview. I briefly inspected the repository in GitHub's web interface, noticed several suspicious files, and decided not to clone or execute anything. I told him I'd need time to review the project before running it. The interview ended immediately. UPD: after closer inspection I found code that downloads and executes a remote JS payload, it was hidden after hundreds blank lines and tabs in vite-env.ts file (last 2 screenshots, URL changed for safety).

• Contact shifts to WhatsApp for further communication
• Promises of job offers or services that are not real

• Advertises non-existent positions on job boards
• Asks for personal data via application forms

Fake jobs feed

Fake jobs feed