SURVIVING THE AI APOCALYPSEA Field Guide for People Who Remember VCRs
MenuClose
Your Career · Field guide No. 016 · November 3, 2026

How to Check a Recruiter's Test or Download Before You Open It (the $6.3 Billion Lesson)

The interview went great. The homework was the heist.

At a glance

You'll need
The recruiter's messages and whatever they've asked you to download, install or open
Cost
Free.
Time
10 minutes
Difficulty
Beginner

First step Treat downloads as a stop sign. Any file, app, browser extension, "interview software" or command a recruiter asks you to run gets checked first, no matter how good the interviews felt.

Saves: Your computer, your accounts and possibly your employer's · Tools: A web browser; ChatGPT, Claude or Gemini for a second opinion

Example result A useful answer lists the red flags in the recruiter's messages (an unverifiable company, pressure to move fast, a file to download or app to install) and tells you exactly what to check, and how, before you open anything.

What to do

  1. Treat downloads as a stop sign. Any file, app, browser extension, "interview software" or command a recruiter asks you to run gets checked first, no matter how good the interviews felt.
  2. Find the company yourself. Search for it independently. Look for a real website, news coverage and the job on its own careers page. A company that exists only in the recruiter's messages is the warning.
  3. Check the people. Look at how old the recruiter's and "CEO's" profiles are, whether LinkedIn shows a verified workplace, and whether anyone you know can vouch for them.
  4. Ask for another way. Request that any test be done on the company's own hiring site, or by sharing your screen while they watch. Real employers can usually manage that.
  5. Keep it off your work computer. Never open job-hunt files on a computer your current employer gave you. That's how one engineer's job search became his employer's problem.
  6. Report it. Use the platform's Report option and file at ReportFraud.ftc.gov. If you already ran something, disconnect from the internet, tell your IT team if a work device was involved, and change passwords from a different device.
The prompt

The prompt

A prompt is the instructions you give the AI. Anything in [square brackets] is a blank for you to fill in. First time? Start here 

I'm job hunting and a recruiter has asked me to [download a file / install an app / open a link / complete a test]. Here are their messages, with names and contact details removed: [paste messages]. Here is what I know about the company: [what you found]. List the red flags you see, explain each in plain English, and give me a short checklist of what to verify before I open anything. Be honest that you can't confirm whether the company or file is safe.
  1. Press Copy prompt.
  2. Open ChatGPT, Claude or Gemini.
  3. Paste it into the message box and fill in the [blanks].

Keep it private. Before you paste: leave out passwords, codes, and account, card, ID and policy numbers. Swap real names for "my mother" or "the company."

Paste the messages, not the file. Remove names, phone numbers and email addresses first.

What to check yourself

  • A chatbot can't tell you whether a file is safe or a company is real. It can only point out warning signs and what to check.
  • Antivirus didn't catch the malware in this case. A clean scan isn't proof a file is safe.
  • Real companies do give take-home tests. The test isn't the warning sign; being unable to confirm who's asking is.
What happenedThe story behind it

On November 3, the crypto exchange Binance published its account of the roughly $6.3 billion theft it suffered on October 29, which Fortune calls the biggest in crypto history. It started in September with a job offer. Someone posing as a "project director" at a company that didn't exist approached one of its engineers. Fortune says the approach came on LinkedIn; BleepingComputer says only that it was a legitimate job-hunting site.

There were two interviews: a video call with a fake HR person, backed by a social media account full of personal photos, then a chat with the supposed CEO. Then came the homework: download a coding assignment from an online code site. Running it quietly installed malware his antivirus didn't catch. BleepingComputer reports the attackers later used an internal AI tool at Binance to break into two more employees' accounts, and that the FBI has attributed the attack to North Korean state hackers.

Crypto and AI keep turning up in the same headlines, so it was natural to wonder whether this was the AI heist people have been bracing for. It landed in what the Atlantic Council called "a season of AI anxiety," weeks after AI-assisted hacking made news. The worry isn't far-fetched: in a December 2025 study reported by The Block, Anthropic found AI agents could exploit about half of the recent crypto contracts it tested, worth $4.5 million in simulated money. But on Binance, the Atlantic Council says there's no public evidence AI was used to break in. The AI showed up later, as a tool the attackers turned against Binance from the inside.

Binance says customer funds are safe, and billions have been frozen. That's the useful part for the rest of us: the door opened through old-fashioned trickery, not a robot. You don't need to be a crypto engineer for this to work on you. A flattering recruiter, real-feeling interviews, and a file, app or link you're asked to open. Plenty of fake job offers follow the same script with a résumé "template," an "interview app" or a "skills test."

The verdict

A real employer can wait the ten minutes it takes you to check them. A fake one gets impatient.

Sources

How sure we are: Based on published reports and official advice. We haven't tested this one ourselves. What this means