Recruitment Scams 1

• Fake recruitment, remote JSON payloads, and function-inliner malware (analysis) May 19, 2026 Clone-and-run recruitment lures that pull obfuscated Node.js from jsonkeeper-style hosts: IOCs, SHA-256 hashes, a small fetch script, function-inliner teardown, MITRE mappings with links, and what to do if you already ran the artifact. 12 minutes