Binance $6.34B Breach Attempt: Fake Job Interviews and AI Tools — Defense Playbook

---
title: Suspicious File Download from Recruitment Domain
id: 8f2e3d41-7c6b-4a9e-b5d2-1e4f6a8c9d0e
status: experimental
description: Detects file downloads from recently registered or suspicious recruitment-related domains. May indicate malicious attachments from fake job interviews.
references:
  - https://attack.mitre.org/techniques/T1566/002/
  - https://securityaffairs.com/202369/cyber-crime/binance-hack-how-fake-job-interviews-and-ai-abuse-led-to-a-6-34-billion-attack.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'technical_assessment'
      - 'coding_challenge'
      - 'interview_prep'
      - 'candidate_evaluation'
  filter_legitimate_downloads:
    SourceFilename|contains:
      - 'github.com'
      - 'gitlab.com'
      - 'stackoverflow.com'
  condition: selection and not filter_legitimate_downloads
falsepositives:
  - Legitimate recruitment processes
  - Internal HR systems
level: medium
---
title: Credential Harvesting via Fake Video Conferencing
id: 9a3f4e52-8d7c-4b1f-c6e3-2f5a7b9d1e2f
status: experimental
description: Detects suspicious network connections to lookalike domains impersonating legitimate video conferencing platforms used in fake job interviews.
references:
  - https://attack.mitre.org/techniques/T1566/002/
  - https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1566
logsource:
  category: network_connection
  product: windows
detection:
  selection_zoom_lookalike:
    DestinationHostname|contains:
      - 'zoom-us'
      - 'zoomgov'
      - 'zoom-video'
      - 'zoomcloud'
    DestinationHostname|endswith:
      - '.com'
      - '.net'
      - '.org'
  filter_legitimate:
    DestinationHostname|contains:
      - 'zoom.us'
      - 'zoom.com'
  condition: selection_zoom_lookalike and not filter_legitimate
falsepositives:
  - Legitimate Zoom subdomains
  - Partner integrations
level: high
---
title: Suspicious Process Execution from Temp Directory
id: 1b4e5f63-9e8d-4c2a-d7f4-3a6b8c0e2f3a
status: experimental
description: Detects execution of files from temporary directories shortly after download, which may indicate malware installation during fake technical assessments.
references:
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|startswith:
      - 'C:\\Users\\*\\AppData\\Local\\Temp\\'
      - 'C:\\Windows\\Temp\\'
    ParentImage|endswith:
      - '\\explorer.exe'
      - '\\chrome.exe'
      - '\\firefox.exe'
      - '\\msedge.exe'
  filter_legitimate_installers:
    Image|contains:
      - 'setup.exe'
      - 'install.exe'
      - 'update.exe'
  condition: selection and not filter_legitimate_installers
falsepositives:
  - Legitimate software installations
  - Browser downloads
level: medium

// Hunt for suspicious file downloads from recruitment-related domains
// Look for files downloaded from recently registered domains or known recruitment lookalikes
let SuspiciousDomains = dynamic(["recruitment", "talent", "careers", "hiring", "job"]);
let RecentDownloads = DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where FolderPath has_any ("Downloads", "Temp")
    | where FileName has_any ("assessment", "interview", "candidate", "challenge", "technical")
    | project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, SHA256;
RecentDownloads
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any (SuspiciousDomains)
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP
) on DeviceName, $left.TimeGenerated == $right.TimeGenerated
| project TimeGenerated, DeviceName, FileName, FolderPath, RemoteUrl, RemoteIP, InitiatingProcessFileName
| order by TimeGenerated desc;

// Detect credential access attempts via suspicious authentication
// Look for authentication attempts to fake video conferencing or assessment platforms
SigninLogs
| where TimeGenerated > ago(7d)
| where AppDisplayName has_any ("Zoom", "Teams", "Webex", "Assessment", "Interview")
| where IPAddress !in (dynamic(["known_corporate_ips"]))
| where ResultType != 0
| extend SuspiciousDomain = iff(AppDisplayName has "Zoom" and not (AppDisplayName contains "zoom.us"), true, false)
| where SuspiciousDomain == true
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Location, ResultType, ResultDescription
| order by TimeGenerated desc;

// Hunt for suspicious process execution from temporary directories
// Focus on processes spawned by browsers or file explorers in temp folders
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("AppData\\Local\\Temp", "Windows\\Temp")
| where InitiatingProcessFileName in~ ("explorer.exe", "chrome.exe", "firefox.exe", "msedge.exe")
| where not (FileName has_any ("setup", "install", "update", "patch"))
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, AccountName
| order by TimeGenerated desc;

// Detect potential data exfiltration to cloud storage
// Look for large uploads to personal cloud storage accounts
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("dropbox.com", "drive.google.com", "onedrive.live.com", "mega.nz", "wetransfer.com")
| where BytesSent > 100000000  // More than 100MB
| where InitiatingProcessFileName !in~ ("onedrive.exe", "googledrivesync.exe", "dropbox.exe")
| project TimeGenerated, DeviceName, RemoteUrl, BytesSent, InitiatingProcessFileName, AccountName
| order by BytesSent desc;

-- Hunt for suspicious processes and network connections related to fake job interview attacks
-- This artifact looks for processes executed from temp directories, suspicious network connections,
-- and files with recruitment-related names

LET suspicious_processes = SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    ParentPid
FROM pslist()
WHERE 
    (Exe =~ 'AppData\\Local\\Temp' OR Exe =~ 'Windows\\Temp')
    AND NOT (Name =~ 'setup|install|update')
    AND CreateTime > now() - 604800  // Last 7 days

LET suspicious_files = SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime,
    IsDir
FROM glob(globs='C:/Users/*/Downloads/*{assessment,interview,candidate,challenge,technical}*')
WHERE 
    Mtime > now() - 604800
    AND Size > 0

LET suspicious_network = SELECT 
    Pid,
    Name,
    LocalAddr,
    LocalPort,
    RemoteAddr,
    RemotePort,
    State,
    CreateTime
FROM netstat()
WHERE 
    RemoteAddr =~ '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'  // External IP
    AND State =~ 'ESTABLISHED'
    AND CreateTime > now() - 604800

SELECT 
    'Process' AS ArtifactType,
    suspicious_processes.Pid AS Pid,
    suspicious_processes.Name AS Name,
    suspicious_processes.CommandLine AS Details,
    suspicious_processes.Username AS Username,
    suspicious_processes.CreateTime AS Timestamp
FROM suspicious_processes

UNION ALL

SELECT 
    'File' AS ArtifactType,
    NULL AS Pid,
    suspicious_files.FullPath AS Name,
    format('Size: %d bytes', suspicious_files.Size) AS Details,
    NULL AS Username,
    suspicious_files.Mtime AS Timestamp
FROM suspicious_files

UNION ALL

SELECT 
    'Network' AS ArtifactType,
    suspicious_network.Pid AS Pid,
    suspicious_network.Name AS Name,
    format('%s:%d -> %s:%d', suspicious_network.LocalAddr, suspicious_network.LocalPort, suspicious_network.RemoteAddr, suspicious_network.RemotePort) AS Details,
    NULL AS Username,
    suspicious_network.CreateTime AS Timestamp
FROM suspicious_network

ORDER BY Timestamp DESC

# Social Engineering Attack Hardening Script
# Run with administrative privileges

Write-Host "=== Social Engineering Attack Hardening ===" -ForegroundColor Cyan
Write-Host "This script verifies and configures security controls to defend against" -ForegroundColor Cyan
Write-Host "fake job interview and AI-assisted social engineering attacks.`n" -ForegroundColor Cyan

# Function to check Windows Defender status
function Check-DefenderStatus {
    Write-Host "[+] Checking Windows Defender status..." -ForegroundColor Yellow
    
    $defenderStatus = Get-MpComputerStatus
    
    if ($defenderStatus.AntivirusEnabled -and $defenderStatus.RealTimeProtectionEnabled) {
        Write-Host "    ✓ Windows Defender is enabled and running" -ForegroundColor Green
    } else {
        Write-Host "    ✗ Windows Defender is not fully enabled!" -ForegroundColor Red
        Write-Host "      Antivirus: $($defenderStatus.AntivirusEnabled)" -ForegroundColor Red
        Write-Host "      Real-time Protection: $($defenderStatus.RealTimeProtectionEnabled)" -ForegroundColor Red
    }
    
    # Check if cloud protection is enabled
    if ($defenderStatus.CloudProtectionEnabled) {
        Write-Host "    ✓ Cloud-delivered protection is enabled" -ForegroundColor Green
    } else {
        Write-Host "    ⚠ Cloud-delivered protection is disabled" -ForegroundColor Yellow
        Write-Host "      Consider enabling for better protection against unknown threats" -ForegroundColor Yellow
    }
}

# Function to check SmartScreen status
function Check-SmartScreen {
    Write-Host "`n[+] Checking Windows SmartScreen status..." -ForegroundColor Yellow
    
    $smartScreen = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" -Name "SmartScreenEnabled" -ErrorAction SilentlyContinue
    
    if ($smartScreen.SmartScreenEnabled -eq "RequireAdmin" -or $smartScreen.SmartScreenEnabled -eq "Warn") {
        Write-Host "    ✓ SmartScreen is enabled: $($smartScreen.SmartScreenEnabled)" -ForegroundColor Green
    } else {
        Write-Host "    ✗ SmartScreen may be disabled" -ForegroundColor Red
        Write-Host "      Enabling SmartScreen..." -ForegroundColor Yellow
        Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" -Name "SmartScreenEnabled" -Value "Warn"
        Write-Host "      ✓ SmartScreen enabled" -ForegroundColor Green
    }
}

# Function to configure PowerShell execution policy
function Configure-ExecutionPolicy {
    Write-Host "`n[+] Checking PowerShell execution policy..." -ForegroundColor Yellow
    
    $currentPolicy = Get-ExecutionPolicy
    Write-Host "    Current policy: $currentPolicy" -ForegroundColor Cyan
    
    if ($currentPolicy -eq "Restricted" -or $currentPolicy -eq "AllSigned" -or $currentPolicy -eq "RemoteSigned") {
        Write-Host "    ✓ Execution policy is appropriately restrictive" -ForegroundColor Green
    } else {
        Write-Host "    ⚠ Execution policy may be too permissive" -ForegroundColor Yellow
        Write-Host "      Setting to RemoteSigned..." -ForegroundColor Yellow
        Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine -Force
        Write-Host "      ✓ Execution policy set to RemoteSigned" -ForegroundColor Green
    }
}

# Function to check Office macro settings
function Check-OfficeMacros {
    Write-Host "`n[+] Checking Office macro security settings..." -ForegroundColor Yellow
    
    $officeVersions = @("16.0", "15.0", "14.0")  # Office 2016+, 2013, 2010
    
    foreach ($version in $officeVersions) {
        $vbaWarnings = Get-ItemProperty -Path "HKCU:\Software\Microsoft\Office\$version\Word\Security" -Name "VBAWarnings" -ErrorAction SilentlyContinue
        
        if ($vbaWarnings) {
            $macroLevel = $vbaWarnings.VBAWarnings
            
            switch ($macroLevel) {
                1 { $level = "Enable all macros (NOT RECOMMENDED)"; $color = "Red" }
                2 { $level = "Disable all macros with notification"; $color = "Yellow" }
                3 { $level = "Disable all macros except digitally signed"; $color = "Green" }
                4 { $level = "Disable all macros without notification"; $color = "Green" }
                default { $level = "Unknown"; $color = "Gray" }
            }
            
            Write-Host "    Office $version : $level" -ForegroundColor $color
            
            if ($macroLevel -eq 1) {
                Write-Host "      ⚠ CRITICAL: Macros are fully enabled!" -ForegroundColor Red
                Write-Host "        Consider disabling or restricting macros" -ForegroundColor Yellow
            }
        }
    }
}

# Function to check for suspicious recently modified files in Downloads
function Check-SuspiciousDownloads {
    Write-Host "`n[+] Checking for suspicious files in Downloads folder..." -ForegroundColor Yellow
    
    $suspiciousKeywords = @("assessment", "interview", "candidate", "challenge", "technical", "recruitment")
    $downloadsPath = [Environment]::GetFolderPath("UserProfile") + "\Downloads"
    
    $recentFiles = Get-ChildItem -Path $downloadsPath -File -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | 
        Where-Object { 
            $fileName = $_.Name.ToLower()
            $suspiciousKeywords | Where-Object { $fileName.Contains($_) }
        }
    
    if ($recentFiles) {
        Write-Host "    ⚠ Found $($recentFiles.Count) suspicious files in Downloads:" -ForegroundColor Yellow
        foreach ($file in $recentFiles) {
            Write-Host "      - $($file.Name) (Modified: $($file.LastWriteTime))" -ForegroundColor Yellow
        }
        Write-Host "    Review these files and scan with updated antivirus" -ForegroundColor Yellow
    } else {
        Write-Host "    ✓ No suspicious files found in Downloads" -ForegroundColor Green
    }
}

# Function to enable audit policies for better detection
function Enable-AuditPolicies {
    Write-Host "`n[+] Enabling enhanced audit policies..." -ForegroundColor Yellow
    
    $auditPolicies = @(
        @{Category="Process Creation"; Subcategory="Process Creation"},
        @{Category="Object Access"; Subcategory="File System"},
        @{Category="Policy Change"; Subcategory="Audit Policy Change"},
        @{Category="Privilege Use"; Subcategory="Sensitive Privilege Use"}
    )
    
    foreach ($policy in $auditPolicies) {
        $result = auditpol /set /subcategory:"$($policy.Subcategory)" /success:enable /failure:enable 2>&1
        if ($LASTEXITCODE -eq 0) {
            Write-Host "    ✓ Enabled: $($policy.Subcategory)" -ForegroundColor Green
        } else {
            Write-Host "    ✗ Failed to enable: $($policy.Subcategory)" -ForegroundColor Red
        }
    }
}

# Function to provide user awareness recommendations
function Show-UserAwarenessRecommendations {
    Write-Host "`n[+] User Awareness Recommendations:" -ForegroundColor Cyan
    Write-Host @"

    CRITICAL: Educate users about fake job interview attacks:

    1. Verify Recruiter Identity:
       - Independently verify recruiter email addresses and phone numbers
       - Check LinkedIn profiles for completeness and authenticity
       - Be suspicious of recruiters contacting you about unposted positions

    2. Video Conference Security:
       - Only use official video conferencing platforms (Zoom.us, Teams.microsoft.com)
       - Never install software from recruitment emails or interview links
       - Be cautious about screen sharing sensitive information

    3. Technical Assessments:
       - Never download or execute files from unknown sources
       - Use virtual machines or sandboxed environments for coding challenges
       - Be suspicious of requests to install "collaboration tools"

    4. Information Sharing:
       - Limit technical details shared during initial interviews
       - Don't discuss internal architecture, security controls, or access procedures
       - Be vague about specific projects until employment is confirmed

    5. Red Flags:
       - Offers that seem too good to be true
       - Pressure to move quickly through the interview process
       - Requests for sensitive information early in the process
       - Unprofessional email domains or communication

    6. Reporting:
       - Report suspicious recruitment contacts to security team immediately
       - Forward suspicious emails to phishing@company.com
       - Don't delete evidence of suspicious contacts

"@ -ForegroundColor White
}

# Main execution
try {
    Check-DefenderStatus
    Check-SmartScreen
    Configure-ExecutionPolicy
    Check-OfficeMacros
    Check-SuspiciousDownloads
    Enable-AuditPolicies
    Show-UserAwarenessRecommendations
    
    Write-Host "`n=== Hardening Complete ===" -ForegroundColor Cyan
    Write-Host "Review the recommendations above and implement additional controls as needed." -ForegroundColor Cyan
    Write-Host "For enterprise deployment, consider using Group Policy or Intune to enforce these settings." -ForegroundColor Cyan
}
catch {
    Write-Host "`nERROR: An error occurred during hardening:" -ForegroundColor Red
    Write-Host $_.Exception.Message -ForegroundColor Red
    Write-Host "Stack Trace:" -ForegroundColor Red
    Write-Host $_.ScriptStackTrace -ForegroundColor Red
}
"@

# Run the main function
& $hardeningScript