Three months later, the attackers approached a second engineer through a job-hunting platform, posing as a project director recruiting for a company that did not exist. Two staged interviews followed: one with a purported HR representative who shared a social media account filled with personal photos and videos to build trust, and one with someone claiming to be the company’s CEO.
At the end of the second interview, the engineer was told to download a coding assignment onto their work computer from a repository. The assignment included malicious code, and this time Binance’s endpoint protection tools did not detect it. The company described this as zero-day malware, but if endpoint protection tools were only capable of detecting known malware, then the whole industry has a problem.
Either way, the developer’s actions raise a number of questions regarding security policies, procedures, and awareness at Binance, first among them: Why was the engineer doing job interviews and test assignments on their work computer? Why did they clone a repository directly on their system instead of using a virtual machine? If this is something they regularly do, then it points to lapses in security training or intentional policy violations. And companies cannot solely rely on employees always following policies. They need detection and enforcement mechanisms.
