What happens when a fake coding test reaches a security company?
Comments on “What happens when a fake coding test reaches a security company?”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Sophos says a fake GitHub coding assignment compromised one employee's Mac in September, when a hidden VS Code workspace command installed the BeaverTail and InvisibleFerret malware within two minutes. A partner's tip revealed it, because the Mac's endpoint agent was broken. Sophos links the technique to North Korean groups and to Binance's reported $6.3 billion theft, though the Binance details, the detection claim and the advisory figures could not be independently checked. Its advice: reconcile identity sign-ins against endpoint telemetry, and limit what AI tools can reach.
Why it ranked
No. 5 of 51 with a score of 0.72. The panel rated it highest on reader interest (0.86) and practical relevance (0.85), lowest on technical depth (0.67).
- AI judgeJudge 2claude-haiku-5-5
- Detailed security incident write-up on fake coding-test social engineering by North Korean groups, with concrete tradecraft, advisory data and practical defenses; partly self-promotional vendor framing lowers substantiation slightly.
- AI judgeJudge 3gpt-5.6-luna
- A detailed incident write-up connects fake coding assignments, compromised developer tooling, endpoint-coverage gaps, and AI access controls, with concrete defensive recommendations and supporting incident/advisory references.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.72total under rubric v2.3
- Significance0.69
- Reader interest0.86
- Audience breadth0.81
- Practical relevance0.85
- Substantiated0.71
- Technical depth0.67
- New information0.74
- Counts against: Promotional0.21
- Counts against: Overclaim0.22
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.70 | 0.60 | 0.78 | 0.69 | 0.18 | +0.24 | +0.166 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.83 | 0.85 | 0.90 | 0.86 | 0.07 | +0.26 | +0.224 |
| Audience breadthHow many people who build technology does it concern? | 0.85 | 0.80 | 0.78 | 0.81 | 0.07 | +0.13 | +0.105 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.87 | 0.80 | 0.88 | 0.85 | 0.08 | +0.22 | +0.187 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.73 | 0.60 | 0.80 | 0.71 | 0.20 | +0.05 | +0.035 |
| Technical depthHow technically substantive is it? | 0.75 | 0.55 | 0.70 | 0.67 | 0.20 | +0.05 | +0.033 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.89 | 0.50 | 0.84 | 0.74 | 0.39 | +0.05 | +0.037 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.09 | 0.35 | 0.18 | 0.21 | 0.26 | −0.19 | −0.039 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.21 | 0.30 | 0.16 | 0.22 | 0.14 | −0.11 | −0.025 |
| Sum of contributions | +0.725 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.725 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-08/5/"><img src="https://rubric.hrih.si/badge/2026-11-08/5.svg" alt="Ranked #5 on Rubric, 8 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 1 matches source · 3 no source given · 4 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
Binance suffered a $6.3 billion theft that began with a job interview.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Binance's $6.3 billion theft, which began with a job interview”
The source says No passage could be compared.
Source cited by the article: coindesk.com/business/2026/11/03/binance-s-usd6-3-billion-hack-began-with-a-fake-job-interview-exchange-says
Couldn’t checkDate
According to Binance, a software engineer was approached in September through a legitimate job platform and told to download a coding assignment onto his work computer.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “a software engineer was approached in September through a legitimate job platform and told to download a coding assignment onto his work computer”
The source says No passage could be compared.
Source cited by the article: coindesk.com/business/2026/11/03/binance-s-usd6-3-billion-hack-began-with-a-fake-job-interview-exchange-says
Couldn’t checkCausal conclusion
Binance says its attacker swapped the legitimate pyenv component in the engineer's Homebrew installation for a malicious version, and that its endpoint tools didn't detect the malware.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “its attacker swapped the legitimate pyenv component in the engineer's Homebrew installation for a malicious version, used it to contact an attacker-controlled server, and cleaned up traces as it went”
The source says No passage could be compared.
Source cited by the article: binance.com/en/blog/community/3229153443759566763
No source givenNumber
SophosLabs confirmed that the first script dropped on the Sophos employee's Mac was already detected as Troj/Dloadr-EJE.
The article gives no link or citation for it.
The article says “SophosLabs confirmed that the first script dropped on the Mac was already detected as Troj/Dloadr-EJE”
The source says No source to compare with.
No source givenCausal conclusion
Binance's attacker used an internal AI tool to move from one engineer to two others.
The article gives no link or citation for it.
The article says “Binance’s attacker used an internal AI tool to move from one engineer to two others”
The source says No source to compare with.
Matches sourceNumber
Chainalysis estimates North Korea stole $2.02 billion in cryptocurrency in 2025, most of it from the $1.5 billion Bybit heist.
The cited source says the same thing.
The article says “Chainalysis estimates it stole $2.02 billion in cryptocurrency in 2025, most of it from the $1.5 billion Bybit heist”
The source says “In 2025, North Korean hackers stole at least $2.02 billion in cryptocurrency ($681 million more than 2024), representing a 51% increase year-over-year”
Source cited by the article: chainalysis.com/blog/crypto-hacking-stolen-funds-2026
Couldn’t checkNumber
Between December 2025 and July 2026, Contagious Interview actors (called WaterPlum in the advisory) compromised at least 30,000 devices in more than 100 countries and took funds or credentials from over 7,000 cryptocurrency wallets.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “compromised at least 30,000 devices in more than 100 countries and took funds or credentials from over 7,000 cryptocurrency wallets”
The source says No passage could be compared.
Source cited by the article: mofa.go.jp/files/101089150.pdf
No source givenFirst, only or fastest
The FBI has attributed the Binance attack to North Korea, using the name TraderTraitor.
The article gives no link or citation for it.
The article says “The FBI has attributed the attack to North Korea”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 4 pts, not on front page
Recorded for context only, checked 8 Nov 2026, 05:46 UTC. It played no part in the ranking.