In this guide · 8 sections
- 01What the SPF-CSA advisory of 14 August 2026 says
- 02Why developers and technical staff are the main target
- 03Warning signs of a fake recruiter or fake interview
- 04HR and IT rules for take-home tests and interviews
- 05Technical controls SPF and CSA recommend for businesses
- 06If someone already ran the test: what to do first
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Treat any take-home test or 'interview tool' from a stranger as untrusted code. Never run it on a work device, verify recruiters through the company's official site, and isolate the device, revoke sessions and reset credentials straight away if someone already ran it.
What the SPF-CSA advisory of 14 August 2026 says
The joint advisory on the Police website describes one case in detail, with losses of USD 11.8 million (about S$15 million). CSA published the same advisory as a PDF on its alerts page. The target was an employee at a technology or cryptocurrency business, but the method works against anyone who can be talked into running a file.
Contact on LinkedIn from a 'recruiter'
The scammer posed as a recruiter from a cryptocurrency-related company and moved the conversation to email.
Emails from a lookalike domain
The emails came from a spoofed domain that closely resembled the real company's domain.
Video interviews with the camera off
Several interviews ran on Google Meet. The interviewer's video stayed off the whole time.
A 'technical coding assessment' on a spoofed site
The candidate was sent to a fake website to complete the test, on his company-issued device.
Malware installed, credentials harvested
The download let the attackers bypass authentication controls, collect internal company credentials and make cryptocurrency transfers.
Nothing in that chain needed a software vulnerability. Every step relied on the employee trusting a believable story, which is why the advisory puts staff education first.
Why developers and technical staff are the main target
The advisory says developers and technical professionals are more likely to be targeted through malicious coding assignments. A take-home test is normal in tech hiring, so asking a candidate to clone a repository, install packages and run a project does not look strange. That is exactly what an attacker needs.
Technical staff also tend to hold the most valuable access: source code, cloud consoles, API keys, deployment pipelines and sometimes payment or wallet systems. One compromised laptop with saved sessions can be enough. The same risk exists in a non-tech SME. A finance executive asked to install a 'video interview plug-in' or open a 'salary benchmark' file is running untrusted software on the machine that approves payments.
This is closely related to the package attacks covered in our guide to npm supply-chain attacks and CSA's advice for SMEs. In both cases the harmful code arrives looking like ordinary developer work.
Warning signs of a fake recruiter or fake interview
The advisory lists the signs to watch for. Brief your team on them, including people who are not job hunting, because LinkedIn approaches reach everyone.
- A recruiter email domain that is close to, but not exactly, the company's real domain.
- Interviewers who refuse to turn their video on.
- Requests to move to unofficial platforms, personal messaging apps or unfamiliar websites.
- A coding test that must be downloaded and run locally, often with a deadline.
- Pressure to use the device you have with you right now, which is often a work laptop.
- A job at a company you cannot find on its own official careers page.
Our guide on how to spot a phishing email covers lookalike domains in more detail. The skills are the same: read the full address, and check the company through a channel you found yourself, not one the stranger gave you.
HR and IT rules for take-home tests and interviews
Most small businesses do not need new tools to act on this advisory. They need a few clear rules that everyone knows, written down once and repeated in onboarding.
Take-home test and recruitment rules
The last point matters if you hire developers yourself. Use a hosted coding platform or a public repository the candidate reviews in a browser, and say clearly in the invitation that you will never ask them to install software from an unofficial site. That protects candidates and protects your brand from being copied.
Technical controls SPF and CSA recommend for businesses
Beyond staff awareness, the advisory lists 'advanced measures'. Here they are in plain terms, with what each means for a small team.
| Advisory measure | What it means in practice |
|---|---|
| Protect API keys and internal credentials | Keep keys in a secrets manager, not in code or chat. Give access on a need-to-know basis and log it. Use short-lived credentials and revoke suspicious sessions fast. |
| Transaction limits and approval workflows | Large transfers need a second person, enforced at the system level so a stolen key cannot skip it. |
| Strengthen MFA | Add device binding, alerts for unusual logins and shorter session token expiry. |
| Monitor access and lateral movement | Watch for new devices, odd logins, privilege changes and unexpected outbound traffic from servers. |
| Segment development and production | A developer laptop should not reach production systems directly. |
| Secure repositories and pipelines | Strict access, logging, and two-person review for changes to deployment instructions. |
For a typical SME on Microsoft 365 or Google Workspace, the realistic first steps are endpoint protection on every laptop, alerts for risky sign-ins, and removing local admin rights so staff cannot quietly install software. Our overview of Microsoft Defender for Business vs antivirus explains what endpoint protection adds.
If someone already ran the test: what to do first
The advisory gives a short response sequence. Speed matters more than perfection, because the attacker's aim is to use the stolen access before anyone notices.
Isolate the device
Disconnect it from Wi-Fi and the office network. Do not wipe it yet; you may need it for investigation.
Revoke active sessions
Sign the user out of every service from the admin console (Microsoft 365, Google Workspace, cloud and code platforms).
Reset credentials and keys
Change passwords and rotate any API keys, tokens or wallet credentials the user or device could reach.
Review access logs
Check sign-ins, repository changes, server access and approval workflows for anything altered.
Get help and report
Notify your IT provider without delay, call the Police Hotline on 1800-255-0000 or make a police report, and check scams with ScamShield on 1799.
For a cyber incident, Singapore organisations can also call the CSA cyber incident helpline, which we covered when it launched. If personal data may have been taken, check whether the PDPA breach notification rules apply.
Do it yourself or get help?
Writing the rules and briefing staff is something an owner can do in an afternoon. Enforcing them on devices, so that software cannot be installed without approval and threats are caught, is technical work.
Our Antivirus & Endpoint Protection Rollout (S$390) puts managed protection on every laptop and removes routine admin rights. If you want your team trained on fake recruiters, phishing and payment scams, our Security Awareness Training (S$390) covers this advisory with a short phishing test.
Frequently asked questions
Issued on 14 August 2026, it warned about a cryptocurrency scam where a fake recruiter on LinkedIn persuaded an employee to run a coding assessment on a company device. The test installed malware that harvested internal credentials, which the attackers used to transfer cryptocurrency. Losses in the case were about USD 11.8 million, or roughly S$15 million.
Only if the test comes from a verified employer, and even then run it in an isolated environment such as a virtual machine or a disposable cloud workspace with no saved logins. Never run it on a company-issued device. If a recruiter insists on a download from an unfamiliar website, treat that as a red flag.
Not fully. The advisory points out that session token harvesting can bypass MFA, because malware on a logged-in device can copy a session the user already approved. Keep MFA, and add short session lifetimes, alerts for unusual sign-ins, device checks and fast session revocation when something looks wrong.
Yes. The case involved a crypto firm, but the method works on any business. Any employee who can be persuaded to install a file on a work laptop can expose email, banking, cloud and customer systems. The basic rules, no outside code on work devices and verifying recruiters, apply to every company.
Isolate the device first, then contact your IT provider. You can give information to the Police Hotline on 1800-255-0000, make a police report online, call ScamShield on 1799 for scam checks, and contact CSA's cyber incident helpline for organisations. Revoke sessions and reset credentials while you wait.