Skip to main content
security · best practices

New Type of LinkedIn Scam

Drew SerhiienkoHead
October 29, 2025 · 5 min read
New Type of LinkedIn Scam
Last month I got a message from Alexander Sullivan — Deputy Director of IT, 500+ connections, premium badge. Offers me a Tech Lead position at an AI healthcare startup. Describes the terms — everything looks good. He even drops my agency name into the conversation to build trust.
He describes the project MEDIRA — an AI platform for medical diagnostics. Tech stack fits: Next.js, React, MongoDB, OpenAI. No red flags yet.
"Can you take a look at our MVP before the technical interview? I'll add you to our private GitHub repo."
I start suspecting something's off. I check out their project, seems fine at first, but I already load the conversation into Claude to analyze for scam patterns (everything seemed too good to be true lol).
I clone the repository but don't run anything — I want to scan it with Claude Code first. It's a tool that analyzes the entire project folder. First I tell Claude the code is suspicious and that it must not run anything.

The Scam Unfolds

Step-by-step analysis of how the scam was detected and prevented

"Project" description

Project Details

2 / 6

What Claude Found

Claude finds weird things:

  • •Production MongoDB credentials in the .env file (live database with medical data exposed)
  • •Code doesn't match the description: healthcare platform, but inside there are real estate models (rooms, price, sqmeter)
  • •test-passwords.js file with a hardcoded password "1309#Mohsin"
  • •References to a "BestCity" project throughout the auth code
Claude suggests I Google "BestCity job interview hack". I find David Dodda's article1 from two weeks ago — exact same scheme. Same BestCity project, same operation.
The malware is hidden sophisticatedly: URLs encoded as byte arrays, payload loaded remotely via new Function(). If I had run npm install, it would've gotten full access to my machine: SSH keys, credentials, crypto wallets.
Looks like a classic test assignment for attention to detail, but this is a professional SCAM. They're targeting developers who are looking for new projects and going through dozens of test assignments.
Bottom line — I stop working with the code and delete everything from my machine completely.
And just recently I came across a Thread where people describe in detail that this is a new type of scam and that they, like me, almost ran the code. They were saved by basic cybersecurity rules, attentiveness, and paranoia.

Key Takeaways

  • •Sandbox ANY unknown code
  • •Use AI to check before running, with EXPLICIT instructions NOT to execute any dependencies (30 seconds can save everything)
  • •Verify everything independently
  • •Trust your instincts
Final thoughts

Final

Of course, I have no claims specifically against Mr. Alexander Sullivan. These guys simply hijack established accounts and use them for their purposes, scamming developers. Although even the final screenshot raises some suspicions...

Sources

[1]
David Dodda: How I Almost Got Hacked by a Job Interview
https://blog.daviddodda.com/how-i-almost-got-hacked-by-a-job-interview

Drew Serhiienko

Head

Let's talk

Got a process worth automating?

A 30-minute discovery call. We listen, sketch the schema live, and tell you whether we're the right fit — straight.

— or —[email protected] ↗