Fake recruiter email as a software engineer: the checks

A recruiter email is probably real if the sender's address matches the company's own domain and the role is on the company's own careers board. It's a scam if it asks for money or ID early, or tells you to run code before you've spoken to a person. We'd check the sender and the role first, and never run a stranger's repo on a laptop that holds work or personal credentials.

Is this recruiter email real? Check the sender first

Do this before you reply, and before you click anything.

Does the address match the company's own domain?

Type the company's name into your browser yourself, open its careers page and compare that domain to the sender's. The FTC says recruiters generally email from a corporate account, not from @gmail.com or @yahoo.com. The FBI's IC3 adds that a search for the company can return several sites for the same name, and a lookalike such as abccompanyllc.com can sit next to the real abccompany.com. A padlock in the browser doesn't prove the site is legitimate.

A Gmail address is a flag, not a verdict. Independent and solo recruiters exist, so let the next check decide.

Is the role on the employer's own careers board?

Search the company's own Greenhouse, Lever or Ashby-style board for the role. IC3 warns about listings that appear on a job board but not on the company's own website. If you can't find it there, treat the message as unverified: either the role doesn't exist or the sender isn't who they say.

What does a scam ask for in the first message?

Money, identity paperwork, or speed. The FTC lists requests for ID, a Social Security number or bank details before you've been interviewed and hired, plus offers that arrive without an interview and a pace that rushes you.

Any of those means stop and don't reply. Don't pay anyone to get a job. A real first message asks about your experience and your availability. If the message reached you by text instead, texts from someone you haven't interviewed with have their own checks.

Should you run the repo or coding test they sent?

Not on your everyday laptop, and not before you've read it. This is the check that can cost an engineer more than money.

What happens when you open or install a recruiter's project?

Microsoft's March 2026 security research describes fake recruiters, often posing as crypto-trading or AI firms, who run a staged process that mirrors a real technical interview. They ask you to clone an NPM package from GitHub, GitLab or Bitbucket and run it. Opening the folder in VS Code isn't the dangerous moment. The trust prompt is: if you click yes, VS Code runs the project's task file automatically, and that file fetches the backdoor. The same research describes a fake interview page that shows an invented error and tells you to paste a command to fix it, which hands the attacker the same access.

Trend Micro's April 2026 research shows where the code hides. The task file is .vscode/tasks.json, and the .vscode folder is hidden by default, so you won't see it in a normal file listing. Check for it yourself. The attackers also pad the code with whitespace so it sits off-screen.

Not every fake recruiter sends code. This is one family, aimed at crypto and AI roles.

How do you open it safely?

Run these in order, and stop at any step that feels wrong.

Open the project in a throwaway virtual machine with no keys, no browser profile and no work VPN or cloud login. Microsoft advises a dedicated, isolated environment such as a non-persistent virtual machine, and never a primary corporate workstation. If you use a container instead, don't attach VS Code to it and trust it.
Let VS Code open it in Restricted Mode. The VS Code docs say an unfamiliar folder starts there, with tasks, the terminal, debugging, extensions and AI agents switched off. A folder inside a parent you already trust, and an attached Docker container, are trusted automatically, so clone into a fresh location outside any trusted folder and choose "No, I don't trust the authors." Trend Micro's advice is to treat that prompt as a security decision.
Read before you run. Open .vscode/tasks.json, the scripts in package.json and any config files. npm install --ignore-scripts installs without running the preinstall, install and postinstall scripts that a plain install runs. (npm ci --ignore-scripts does the same, but only works if the project has a package-lock.json.) Neither makes the app itself safe: npm start still runs the project's start script, so read it first.
Never paste a command from a "fix this error" page. Microsoft treats paste-and-run commands as high-risk, along with requests to trust unknown authors, short links to file hosts, and newly created repos or accounts.

What if the test is a real company's?

Real take-homes exist, and they're not a red flag on their own. Ask for a company-hosted or browser-based exercise, or a repo under the company's own GitHub organisation that you can find from its careers page.

What if you already ran it?

That happens, and it doesn't say anything bad about you. Our take: treat every secret on that machine as exposed and rotate it from a clean device. Microsoft lists what this malware harvests (credentials, crypto wallets, password-manager artifacts, keys, clipboard contents) and recommends short-lived credentials and MFA. Report it at ic3.gov.

Worked example: one backend engineer, two messages

Dana, in this example, is a backend engineer who gets two messages in the same week.

The first is from a @gmail.com address about a "senior Node role at a crypto-trading firm", with a GitHub link. She types the firm's name into her browser, finds its careers site and sees no matching role. The sender's domain doesn't match either. She stops there and opens nothing.

The second comes from the company's own domain, about a role she finds on its Greenhouse board. The recruiter sends a take-home repo. She opens it in a throwaway virtual machine, in Restricted Mode, and reads .vscode/tasks.json and package.json. Both are clean, so she installs with scripts off and runs it.

The first took five minutes and cost nothing. The second took a little longer, and she was never exposed.

Where this fits in HighCircl Job Search

The role check is the one a search tool can help with. HighCircl Job Search lists a role only if it's on the employer's own board, with no reposts or recruiter copies, so a role it doesn't show is worth checking on the company's page yourself. It's free during the open beta, which is open to 300 people in the US.

What to do with the suspicious email in your inbox this week

Start with the one that made you read this. Run the sender check, then the role check, and decide: reply, ignore, or verify first. If either fails, delete it and don't open anything attached.

Then do the same for the rest of the recruiter mail, a few minutes each. Most decisions fall out at the sender or the role. If a real one sends code, use the safe-open steps above, on a machine that holds nothing you'd miss, or take up the company-hosted option from earlier.

If the role is on no board you can find, how to tell whether a posting is real covers that check in depth. Outside the US, report fraud to your national fraud reporting service rather than ic3.gov.

FAQ

Is an email from a Gmail address always fake?

No. The FTC says recruiters generally use a corporate account, so a Gmail address is a reason to check, not proof of a scam. Compare the role against the company's own careers page.

Is a take-home that is a GitHub repo a red flag?

Not by itself. Real companies send repos. What matters is who sent it and where it lives: a repo under the company's own organisation, from a sender you've verified, is different from a link in an unsolicited message. Open either one in an isolated environment.

Can opening a repo in VS Code run code?

Yes, if you trust the folder. Microsoft and Trend Micro describe fake interview projects whose .vscode/tasks.json runs when the folder opens after you accept the trust prompt. Restricted Mode keeps tasks switched off until you do.

Where do I report a fake recruiter?

In the US, report it to the FBI's IC3 at ic3.gov.