When the Job Interview is Actually a Cybercrime Recruitment Attempt

The cybersecurity job market is brutal. For every legitimate penetration tester position, there are hundreds of qualified applicants, many of whom face months of rejections before landing their first role. My friend Hamza knows this struggle intimately. But his persistence nearly led him down a dangerous path—one that could have turned him from job seeker into unwitting cybercriminal.

The Setup

Hamza specializes in web application penetration testing. He’s proficient with Burp Suite, understands the OWASP Top 10, and knows his way around vulnerability chains. Like many aspiring pentesters, he’d been casting a wide net with job applications, hoping something would stick.

Then came an email that seemed like a breakthrough.

“I don’t even remember applying to this position,” Hamza told me. “They claimed to have my CV from seven or eight months prior and reached out about an interview for what looked like a legitimate web app pentesting role. I was excited.”

That excitement didn’t last long.

The Red Flags Emerge

Hamza’s first step was basic OSINT—the kind of research any security professional would conduct. The company had zero online presence. No website. No LinkedIn page. No digital footprint whatsoever. For a company supposedly operating in the cybersecurity space, this absence was deafening.

Initial communication came through Gmail—unprofessional but not unheard of for smaller operations. What came next, however, crossed a line that any security professional should recognize.

“They asked me to interview over Telegram,” Hamza explained. “That’s when my gut started telling me something was off.”

In the information security world, Telegram occupies a particular niche. While it’s a legitimate messaging platform used by some security researchers, it’s also notorious as a haven for cybercriminal marketplaces, pirated software distribution, and low-effort scams. No legitimate company conducting ethical hacking interviews would use it as their primary communication channel.

The Pitch

What the “recruiters” sent next removed any remaining doubt about their true intentions:

“We are a small company that has been around for over 5 years, with remote technical staff based all over the world. Our main business is SEO work, which is why we need a large number of skilled individuals who can get shell access to Chinese websites to support our SEO team in the next stages.”

Let’s be clear: gaining unauthorized shell access to websites isn’t SEO work—it’s computer fraud. The pitch continued with barely concealed illegality:

“Right now, we are urgently looking for talent experienced in getting shells. If this happens to be your area of expertise, then you’re exactly the kind of partner we’re looking for.”

The Interview Questions That Weren’t

Professional penetration testing interviews typically dive deep into methodology. Interviewers want to understand how you approach reconnaissance, how you chain vulnerabilities together, how you document findings, and how you communicate with clients. They ask about specific vulnerability classes—SQL injection, cross-site scripting, insecure direct object references—and want to hear your thought process.

These “recruiters” had only one question: How many shells have you popped?

“They didn’t care about methodology, process, or professional pentesting approaches,” Hamza said. “They only seemed interested in one thing: popping shells.”

No questions about responsible disclosure. No discussion of rules of engagement or scope documentation. No interest in the professional and ethical frameworks that separate legitimate security work from criminal hacking.

The “Job Offer”

The final nail in the coffin came with the compensation structure. The organization provided a list of websites—sites they had no authorization to test—and offered payment for successful compromises:

• $300 for five shells
• Maximum weekly payout of $1,200
• Bonuses ranging from $15to$500 based on the “actual value of the site to the organization”

This wasn’t a job offer. It was a criminal enterprise recruiting accomplices.

What Makes This Dangerous

This scam is particularly insidious because it targets people with legitimate skills who are desperate for employment. The perpetrators understand the penetration testing job market well enough to craft a pitch that might appeal to frustrated job seekers who’ve been told they need “hands-on experience” to get hired.

But let’s be absolutely clear about what accepting this “position” would mean:

1. Computer Fraud and Abuse Act violations: Accessing computer systems without authorization is a federal crime in the United States, punishable by fines and imprisonment.
2. International cybercrime: The targeting of Chinese websites suggests potential involvement in international criminal operations, which could lead to far more serious legal consequences.
3. Permanent career destruction: A criminal record for computer fraud doesn’t just end your cybersecurity career—it makes you unemployable in any field requiring a background check.
4. Personal liability: The criminals running this operation face minimal risk. Their “employees” are the ones who would face investigation, prosecution, and imprisonment.

How to Spot Similar Scams

If you’re job hunting in cybersecurity, watch for these warning signs:

Communication red flags:

• Initial contact through personal email accounts (Gmail, ProtonMail) rather than corporate domains
• Requests to move conversations to Telegram, Discord, or other platforms favored by criminals
• No verifiable company presence online

Job description red flags:

• Emphasis on “getting shells” without discussion of authorization, scope, or methodology
• Payment based on successful compromises rather than hours worked or projects completed
• Vague descriptions of the actual business or client base
• Claims that online presence is unnecessary because they don’t rely on “advertising or promotion”

Interview red flags:

• No technical deep-dive into your methodology or thinking process
• Only questions about quantity of successful attacks
• No discussion of legal frameworks, contracts, or rules of engagement
• Provision of target lists without authorization documentation

The Bottom Line

The cybersecurity job market is challenging, especially for those seeking their first role. But desperation should never lead you to compromise your ethics or your freedom.

Legitimate penetration testing work always operates within clearly defined legal boundaries. There are contracts. There are rules of engagement. There is explicit authorization. If someone is offering you money to compromise systems without these protections, they’re not offering you a job—they’re recruiting you for criminal activity.

Hamza’s story has a happy ending. He recognized the red flags, declined the “opportunity,” and continues his legitimate job search. His skills and persistence will eventually land him the right role—one that won’t end with a criminal record.

To everyone out there grinding through the job search: stay strong, stay ethical, and trust your instincts. The right opportunity will come, and it won’t arrive via Telegram asking you to hack Chinese websites for SEO purposes.

If you encounter similar scams, report them to the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov. Your report could help protect other job seekers from falling into the same trap.