The Hiring Safety Playbook

  Howdy, my lovely recruiter friends. Two weeks ago, I put a newsletter out saying that recruitment is at the forefront of cybercrime. One day later, the biggest hack in history happened at Binance. $6.3 billion was stolen from their hot wallets, and one of the main points of ingress was from a recruitment scam. I got a few phone calls, largely from friends asking if I had anything to do with it. I told them if I'd just successfully stolen $6.3 billion, there would be signs, namely a solid gold stetson hat and a marble statue of Kim Jong Un behind me winning the 2024 Olympic men's 100-metre sprint. But in all seriousness, I've spent the past two weeks mainly speaking to my lovely CISO, making sure that my own company is at the forefront of protecting both candidates and our employees from these kinds of attacks. This whole newsletter is dedicated to that. I wanted to give you something that was real, practical, and useful that you can keep. Here is a full hiring safety playbook. This is what I'm using. Of course, it changes month for month in a weird world like this, but I offer to you as a gift my 2026 hiring safety playbook.

Unfortunately, this will mean there are marginally fewer penis jokes in this issue, but I promise that next week there will be twice as many penis jokes. Oh, also, I’ll be talking about this in detail today with the PromptMates crew at 5pm GMT, (12pm ET). link here if you want to join (its free!!)

The Hiring Safety Playbook

How recruiters protect candidates, colleagues and their company from fake-recruiter attacks. Built after a fake job interview opened the door to the biggest crypto heist on record.

Why this matters now: Binance was hacked through a job interview

On 29 October 2026, attackers took about $6.3 billion out of Binance, the largest crypto theft on record. The FBI attributes it to North Korea’s TraderTraitor group; North Korea denies it. Binance’s own account says it started with something every growing company does: a recruiter reaching out to an engineer.

A DevOps engineer downloads a tampered Homebrew installer while looking for an AI coding tool. Binance catches it and rotates credentials, but the attackers have already learned his role and who his colleagues are.

A second engineer is approached on a legitimate job-hunting platform by a “Project Director”. Two interviews follow: one with a fake HR contact who shares personal photos and videos to build trust, one with a fake “CEO” on a chat app.

At the end of the second interview he is asked to download a technical “assignment” onto his work computer. It contains malware that runs during setup and is not picked up by Binance’s endpoint tools.

The attackers use that laptop and an internal AI tool to reach two more engineers, and find a token with container-deployment permissions.

Using those credentials they deploy a container and call an internal signing service. About $6.34 billion in assets are affected; roughly $2.85 billion is frozen or intercepted by 3 November.

devices infected in 100+ countries by one fake-interview group in eight months (joint advisory, 18 Sept 2026)

lost to dozens of smaller fake-interview attacks in the 18 months before Binance (Chainalysis)

North Korea-linked attempts Binance says it detected and stopped in 2026, including fake interviews Binance has a serious security team and still got caught. Recruiting is a trusted channel: people welcome a recruiter’s message instead of questioning it. Attackers use that trust to reach the people who can access your systems, and they borrow your company’s good name to reach candidates. You are exposed in both directions. A few published, repeatable habits close most of that gap.

Three ways recruiting gets attacked

Most teams only think about the first. Attackers use all three, often with the same infrastructure.

01. Fake recruiters using your name

Scammers impersonate your company to job seekers: lookalike domains, fake recruiter profiles, ads you never posted. Candidates lose money, data and devices, and your employer brand takes the blame.

• Candidates asking about interviews or roles you don’t recognise
• Profiles claiming to be in your team that you’ve never met
• Email from lookalike domains, e.g. yourco-careers.com
• Candidates mentioning tools you don’t use

02. Fake recruiters aimed at your people

Attackers approach your engineers, DevOps and finance staff with attractive roles. The hook is a coding test, a “driver fix” before a video call, or a command to paste. The goal is a foothold on a machine that can reach your systems.

• Interview “assignments” sent as repos, zip files or npm packages
• A camera or audio “error” with a fix to install or run
• Unknown platforms, chat-app interviews, polished fake companies
• Pressure to run something on a work laptop

03. Fake candidates applying to you

State-linked IT workers and fraudsters apply for remote roles with stolen or forged identities, aiming for salary, access, or both. The September joint advisory links the same infrastructure to both the malware campaign and this fraud.

• Unusually broad skill lists they can’t discuss in detail
• Glancing at another screen, background voices, frozen video
• Face-swap video that goes off “for network reasons”
• Reluctance to meet in person, or pay requested to a third party

The setup guide: Set up your candidate trust stack

Eight steps. A small TA team can get through all of them in a week.

• Three named recruiters, each linked to their LinkedIn profile.
• One recruiting email domain, published on the careers page.
• Interviews on one named video platform, with invites from that domain.
• Agency policy stated in one line.
• A published “never” list, and one inbox for reports.

Step 01: Name your recruiters

• List everyone who recruits for you: TA, founders, HR, ops and any agency, with title and LinkedIn link.
• Publish it on your careers page and link to it from every job ad.
• Update it the day someone joins or leaves, and say plainly that anyone not listed is not you.

Step 02: Own one email domain

• Recruit from one company domain only. Never from personal Gmail, Telegram or WhatsApp.
• Ask whoever runs your email (Google Workspace, Microsoft 365) to set up SPF, DKIM and DMARC so spoofing you is harder.
• Register the obvious lookalikes (yourco-careers, yourco-jobs) before scammers do.

Step 03: Publish your hiring stack

• List the tools a candidate will meet: video interviews, scheduling, assessments, ATS, onboarding.
• Keep the list short, and prefer browser-based tools that need nothing installed.
• State the rule: you will never ask anyone to install software to join an interview.

Step 04: State your agency policy

• No agencies? Say so in one line. Anyone claiming otherwise is not authorised.
• Using agencies? Name each one, with its email domain and a named contact, and require them to introduce themselves as an agency.
• Review the list every quarter.

Step 05: Write your “never” list

• We never ask you to install software, run a command or download a file to join an interview.
• We never ask you for money, equipment deposits, or bank, card or ID details before an offer is signed.
• Every recruiter and hiring manager reads it and follows it, with no exceptions for “urgent” hires.

Step 06: Publish it where candidates look

• Careers page, job-ad template and ATS posting footer.
• First outreach message, calendar invites, and the auto-reply from your recruiting inbox.
• Your LinkedIn company page (About section and a pinned post) and your offer email.

Step 07: Make your own process look nothing like a scam

• No take-homes as zip files or repos that candidates must run locally. Use a hosted environment, a live session or a read-only review.
• No interviews over chat apps and no unannounced platforms.
• No payment for equipment, no cheques, and no bank or ID details until the offer is signed, collected through your onboarding system.

Step 08: Monitor, log and report

• Once a month, search LinkedIn for people using your company name with recruiter titles, and report any you don’t know. Admins of a verified company page can remove people falsely claiming to work there, so get your whole TA team verified.
• Search job boards for ads you didn’t post, and watch for new lookalike domains.
• Log every report: date, platform, fake profile or domain, role advertised, how far the candidate got. After a couple of months you’ll see which roles get copied.
• Report to the platform, and to Action Fraud (UK) or the FBI’s IC3 (US).

Protect your own people

Publishing your process protects candidates. These habits protect your colleagues, systems and code when the fake recruiter is aimed at you. Most cost nothing. Take this section to IT.

Anyone with admin, production, finance or payment access is a high-value target. Make it normal to say “a recruiter just messaged me” in a team channel.

Use a throwaway VM or a separate device. Joint-advisory guidance: only run unknown code in a sandbox, and be wary of commands containing curl, base64, -enc, mshta, Invoke-WebRequest or “hidden”.

Open them in VS Code Restricted Mode by answering “No” to the trust prompt, and check .vscode/tasks.json for downloads or auto-run commands before trusting a folder.

Binance’s attackers found a deployment token on an engineer’s machine. Use short-lived, tightly scoped credentials and hardware-key MFA.

Binance reports attackers used an internal AI tool to reach other engineers’ machines. Assistants and automations should get only the access the task needs.

The June Binance foothold came from a tampered installer. Get developer tools from the vendor’s own site or your package manager.

EDR on every developer machine, plus a no-blame way to report a mistake within minutes. The faster a mistake is reported, the smaller it gets.

Harden your onboarding: Your new hire might already be infected

One group infected 30,000+ devices in eight months with fake coding tests. In a niche talent market, that is a meaningful slice of your candidate pool. Attackers don’t need to target your people directly. They can infect the market and wait for some of those candidates to get hired. The weak spot: the laptop arrives late, so for week one your new hire logs into email, Slack, GitHub and your ATS from their home machine. If that machine picked something up from a fake take-home months ago, whatever is on it now has your credentials.

Kit lands before day one, or day one moves. Your hiring manager won’t love it. Explain why and most will get it.

Strict, yes. For anyone touching production, finance, payments or customer data, it is worth the friction.

Map every step from signed offer to first login, and name who owns each one. Most gaps live in the handover between the two teams.

If a personal device is ever used, IT checks it before it gets credentials, and access is limited and time-boxed until the company device arrives.

Week-one access should match week-one work. Production, admin and payment access gets added once the person, and their device, are verified.

The person on the first call should be the person you interviewed and the person on the ID. The candidate checks below cover how.

Hiring-side checks: Spot fake candidates

Recruiters are the front door. These checks help confirm the person who walks through it is who they say they are.

Check ID before the offer and again on day one.

Contact past employers directly, using details you found yourself. Be wary of references reachable only on Telegram or WhatsApp.

A very broad CV with many languages and platforms can hide several people behind one name. Ask for detail on each.

Hometown, local weather, hobbies, what’s outside their window. Scripted answers tend to wobble.

Lips out of sync, glances to a second screen, background voices, repeated freezes, or video switched off “due to network issues” after a few minutes.

Run pay through normal payroll to an account in the employee’s own name. A request to pay a third party is a big red flag. Send equipment only to the address on the verified ID.

Compare IP address with claimed location, and be cautious of bursts of applications for roles that usually get few.

If you suspect a North Korean IT worker, contact the police (Action Fraud in the UK) or the FBI in the US. Knowingly paying one may breach sanctions law.

Copy-and-paste templates

Replace the [brackets] and use them as they are. Keep the message identical everywhere candidates meet you.

Hiring safely with [Company] We will never ask you to install software, run a command, or download a file to join an interview. We will never ask you for money, or for bank, card or ID details before you have signed an offer. Who you will hear from: [Name, title, LinkedIn link] / [Name, title, LinkedIn link]. Anyone else is not us. Our recruiters only email from @[yourdomain.com]. We interview on [Google Meet / Zoom / Teams]. [We do not use recruitment agencies. / We work only with: Agency, @domain, contact.] Think you have been contacted by a fake recruiter? Email [

].

Recruiting at [Company] is always free. Our recruiters email only from @[yourdomain.com] and are listed at [careers URL]. We will never ask you to install anything or pay for anything.

Not sure this is really us? Check that I’m listed at [careers URL] and that this email came from @[yourdomain.com]. We will never ask you to install software or send money.

This interview is on [Google Meet / Zoom / Teams]. Join with the link in this invite; you don’t need to install anything. If anyone asks you to, stop and email [

].

A: [Company] does not use third-party recruitment agencies. Anyone claiming to represent us in that way is not authorised. B: [Company] works only with these recruiting partners: [Agency, @domain, named contact]. If your recruiter is not listed, email [

] before replying.

Your company laptop will arrive before your start date. Please don’t log in to any [Company] systems from a personal device. If your kit hasn’t arrived, tell us and we’ll move your start date.

Incident response: If something goes wrong

If someone on your team has run something, or a candidate reports a fake recruiter, work through these in order. Loop in IT or security at step one.

1. Disconnect. Take the affected device off the network. Don’t use it to investigate.
2. Rotate from a clean device. Revoke sessions and change passwords, API keys and tokens the machine could reach. Start with email, cloud, code hosting, deployment and payment access.
3. Assume anything on it is out. Files, saved passwords, keys and any crypto wallets on that machine are compromised. Replace them from a clean device.
4. Preserve evidence. Keep messages, profile links, files and screenshots. Don’t delete anything.
5. Report. Action Fraud (0300 123 2040) in the UK; FBI IC3 (ic3.gov) in the US; the platform where it happened; and your own security contact.
6. Wipe or replace. Fully reset the operating system before reuse. Undetected malware can survive clean-up.
7. Review the blast radius. What could that person reach? Check for movement to colleagues’ machines, as in the Binance case, and log what you learn.

The checklist at a glance

The whole playbook in four groups. Use it as a quick reference, or as the agenda for a working session with IT.

• Recruiters named, with LinkedIn links
• One recruiting email domain declared
• Hiring tools listed (interviews, assessments, ATS)
• Agency policy stated (none, or named)
• “Never” list live on the careers page

• Notice added to the job-ad template
• Line added to first outreach and calendar invites
• LinkedIn company page updated
• Recruiting inbox auto-reply updated

• SPF, DKIM and DMARC set for your domain
• Lookalike domains registered
• Interview code never runs on work machines
• No standing deploy tokens on laptops; hardware-key MFA on
• Company device before day one; no personal machines

• Monthly LinkedIn and job-board sweep in the calendar
• Report log started
• Incident steps shared with the team
• Candidate checks agreed (ID twice, employer verification, pay to own account)

  Well... that's issue Eighty Five! If you have any questions about it, or any feedback on this issue of The Data Driven Recruiter, grab me on LinkedIn for a chat.