Attack Interview 03 — Indicators and what to look for

What would I look for on a machine where someone opened this take-home and let the editor run its tasks? I would start with the process tree and the time of the interview, then check whether those processes made the requests the source describes. The saved Git history gives us several concrete leads.

Network references in the retained history

I scanned the committed task and auth files and decoded only URL-shaped values for AUTH_API and AUTH_API_KEY in tracked environment files. The expanded pass found 26 unique host references across both clones. I separate them by where the reference appeared and whether the corresponding loader was present in the same snapshot. These are historical indicators from source. Host availability and successful execution were outside this review.

Evidence class	Hosts	Where the values appear
Editor download commands	8	.vscode/tasks.json, with a folder-open task and a downloader
Jackpot beacon	4	Base64 URL in a route with process.env, eval, and a repeating timer
Environment POST configuration	10	AUTH_API alongside the route constructor and controller POST
Other historical configuration	4	AUTH_API_KEY references whose connection to the same loader was unverified

Jackpot beacon. All four addresses below appear in the route as plain HTTP on port 1224 with path /api/checkStatus.

Address	Example Jackpot commit containing it
147[.]124[.]212[.]180	4baa179d64bd
147[.]124[.]212[.]207	f6c017386671
216[.]250[.]251[.]187	de75f7a9f040
216[.]250[.]252[.]245	3c9749cd6988, the retained head

Editor downloads. The shared suffix is [.]vercel[.]app. The subdomains 0g-auth-check, oracle-v3-nu, and oracle-reg-check appear with /api/validate. The five subdomains ip-address-check-moa5, vscode-check-mo1, vscode-check-mo2, vscode-settings-0511, and vscode-settings-529 appear with /api/settings/mac, /api/settings/linux, or /api/settings/windows. At the retained Jackpot head the task uses vscode-check-mo2.

Environment POST. Under the same Vercel suffix, I found these /api destinations alongside the corresponding loader: api-royaljapan, api111-jade, ip-check-pc, ip-checking-notification-pic, ip-core-api-0511, ip-testcheck, ipcheck-royal, ipcheck-six, project-mjecx, and test-ip-check. Amonix’s retained head points to ip-testcheck[.]vercel[.]app/api. The four configuration-only /api/data subdomains were ake-test, astrahub, rgg-vercel, and test-g-acs.

For matching a saved copy, these are SHA-256 hashes of the exact committed route files, including their original whitespace.

Source file	SHA-256
Jackpot 3c9749cd6988:routes/api/auth.js	0fe2f88e19dbbb1523bb5b3d9adbf46bfa56eec5fb583ecbf04942dc5d86703a
Amonix 82ab33b18b76:routes/api/auth.js	28e73ce85db813ba0839ee077428eaa121037e3a1ec8a13b1171e68cc2a0accd

What makes a useful hunt signal

• Editor or npm process tree. Around the interview time, look for VS Code spawning a shell that launches curl or wget, or an install spawning node server from the checkout. Correlate the parent process, working directory, command line, and destination.
• Repeated outbound GETs. Look for Node contacting port 1224 and /api/checkStatus at about five-second intervals, with fields named sysInfo, processInfo, tid, and sysId. Query strings may contain secrets. Preserve them in restricted evidence storage.
• An outbound POST at startup. Look for Node reaching an exact matching hostname with x-app-request: ip-check, where your telemetry records headers. Correlate that with execution of the repository. Shared hosting makes the full hostname and path more useful than the provider domain alone.

Where it fits in the public research

Kudelski Security independently documented a related auth.js sample with the same unusual tid text, request shape, port, and status: error evaluation condition, using a different IP address. OpenSourceMalware reported the editor-task delivery pattern. These are concrete overlaps with activity tracked as Contagious Interview. Unit 42 documented BeaverTail and InvisibleFerret in that campaign. My local evidence establishes the loaders in these snapshots. Operator identity and any downloaded second stage remain unverified for this case. Kudelski’s technical analysis · OpenSourceMalware’s VS Code research · Unit 42 campaign research · MITRE ATT&CK G1052

If one of the execution paths may have run, isolate the device and involve your security team. Record the repo and revision, interview time, and actions you took. Revoke exposed sessions and rotate accessible credentials from a known-clean device. Include source control and cloud access in that review, since developer credentials can reach beyond the laptop. For a new take-home, verify its origin independently, inspect its workspace and lifecycle settings first, and use a disposable environment without work credentials if execution is required. Atlassian’s guidance for candidates and responders

In this series · 01 — The recruiter and the borrowed Git history · 02 — What could run before the login screen