Is Chris Barber (impersonated?), Finn Carter (impersonated?); impersonated companies: MotorMint, BestPeers, AVALabs a scam?

What people reported

1. Based on my original post on LinkedIn: https://www.linkedin.com/posts/dmitriiprusakov_linkedin-jobsearch-scam-activity-7492972814103109632-M0wH/

   Post:

   Yesterday I almost became the target of a sophisticated "technical interview" scam.

   Last Friday I received a message from a guy on LinkedIn named Chris Barber.
   Nothing looked particularly suspicious:

   • A normal-looking profile.
   • A Frontend Engineer position with basic description.
   • A startup called MotorMint.
   • A Calendly link to schedule an interview.
   • The account title was HR_BestPeers.
     Everything looked like a typical recruiting outreach.

   Despite that warning, I decided to join the call out of curiosity and to see whether they were still running the same operation.

   This time, the interviewer joined as Finn Carter (impersonated identity), kept the camera off.

   After a few standard HR questions, he asked me to share my screen and "inspect" a public GitHub repository.

   At first glance it looked like a normal project, but a few things immediately felt wrong. The repository is published under an account impersonating Ava Labs (using their branding and avatar). Previously they were impersonating MotorMint. That's already at least the third identity they've used.

   The interviewer wasn't interested in discussing architecture or reviewing code. He wanted me to clone the repository to "review the project" and run it on my own machine during the interview.
   I briefly inspected the repository in GitHub's web interface, noticed several suspicious files, and decided not to clone or execute anything.
   I told him I'd need time to review the project before running it.
   The interview ended immediately.

   UPD: after closer inspection I found code that downloads and executes a remote JS payload, it was hidden after hundreds blank lines and tabs in vite-env.ts file (last 2 screenshots, URL changed for safety).

   anonymous report · Aug 17, 2026