@mushu@social.troll.academy

Fiona @mushu@social.troll.academy

· 4mo ago

I've got a job interview at 15:00 CEST.

With a company that entertains creating a cross-cutting position for me. I'm excited and have some hopes.

Also I'll apparently bring some slides this time 🍿 - it appears that's who I'm turning into.

Have a meeting where I can explain something? You'll get some slides. :P

14

6

0

Fiona @mushu@social.troll.academy

· 8mo ago

Replying to

@temptoetiam@eldritch.cafe hey :) yes - I was lucky to detect foul play and happened to be careful. I found that software would've run that loaded and executed other software. From what I could see the setup in the end was one where my machine would've executed whatever the attackers wanted with user privileges. I'm not 100% sure what the endgame would've been. Could've gone for ransomware, information stealing, botnets you name it.

26

2

0

Fiona @mushu@social.troll.academy

· 8mo ago

Replying to

@0xabad1dea@infosec.exchange oh hey, thanks for highlighting this 💖. It may have come just in in time to safe me 😅. Hard to say what would've happened otherwise, but I believe I've just been invited to a private repo on GitHub that has funny stuff in the tasks.json. There are some spaces between the command key and value to shift the command out of view when opening the tasks.json in the editor 🍿. It appears they've got a (git) history of hopping between free projects on vercel to host some stuff.

24

2

9

1

Fiona @mushu@social.troll.academy

· 8mo ago

Replying to

@codecat@meow.social yeah, that's sad indeed.

7

0

Fiona @mushu@social.troll.academy

· 10mo ago

Replying to

@mcc@mastodon.social in case of interest: she's on fedi, too :) https://infosec.exchange/@rebane2001/115661669658436967

infosec.exchange

9

0

Fiona @mushu@social.troll.academy

· 8mo ago

Replying to

@sol_hsa@mastodon.gamedev.place yeah - I also think it's bigger than a single editor. Jetbrains does it too: https://www.jetbrains.com/help/idea/project-security.html Not even starting to think about editors that are more 'AI enabled' ^^

IntelliJ IDEA Help

Project security | IntelliJ IDEA

6

0

Fiona @mushu@social.troll.academy

· 8mo ago

Replying to

@morl99@hessen.social yes, I agree it could be more explicit. That'd also aid with the step of attackers trying to obfuscate the code execution by adding whitespace in the json.

6

2

0

Fiona @mushu@social.troll.academy

· 8mo ago

Replying to

@freya@raru.re thanks 💖 If fedi is any measure there are amazing, kind people out there. Some of them even do software.

5

0

Fiona @mushu@social.troll.academy

· 8mo ago

Replying to

RE: https://social.troll.academy/@mushu/115937976404644181 @0xabad1dea@infosec.exchange Wrote down some notes: https://runjak.codes/posts/2026-01-21-adversarial-coding-test/

social.troll.academy

Fiona: "Sometimes the job interview just wants to gain co…" - Mastodon

5

0

3

0

Fiona @mushu@social.troll.academy

· 8mo ago

Replying to on social.troll.academy

Thanks to @cxiao@infosec.exchange for highlighting these: https://www.jamf.com/blog/threat-actors-expand-abuse-of-visual-studio-code/ https://opensourcemalware.com/blog/contagious-interview-vscode .. I do know that the version of tokenlinux.sh I retrieved also downloads node and executes something with it.

Threat Actors Expand Abuse of Microsoft Visual Studio Code

jamf.com

Threat Actors Expand Abuse of Microsoft Visual Studio Code

Jamf Threat Labs uncovers North Korean hackers exploiting VS Code to deploy backdoor malware via malicious Git repositories in the Contagious Interview campaign

2

0

Fiona @mushu@social.troll.academy

· 8mo ago

Replying to

@SiteRelEnby@transfem.social 👋 :) https://social.troll.academy/@mushu/115937976404644181

social.troll.academy

Fiona: "Sometimes the job interview just wants to gain co…" - Mastodon

2

0

Fiona @mushu@social.troll.academy

· 8mo ago

Replying to

@zedaardv@mastodon.world outch - sorry to hear that 🫤 I mean there are some cases where device surveillance makes sense from a compliance perspective, but it should never be a surprise and be clearly documented upfront.

2

0

Fiona @mushu@social.troll.academy

· 7mo ago

Replying to

@noelle@mastodon.noelle.dev @ratfactor@mastodon.art this resonates and still comes back to mind. I've felt a sense of loneliness when I discover that others care less about both how things work and correctness. I find enormous joy in shared understanding and pooling thoughts and I've felt that ai breaks a lot of that. The moment some peers are just interested in delivering something with speed and in outsourcing the creative process I enjoy so much. I feel this post puts that in words I've been looking for.

1

0

Fiona @mushu@social.troll.academy

· 5mo ago

Replying to

@blinry thank you. I must admit I'm troubled by how papers [1,2] seem to state one direction yet so little concern seems to be extended to it in everyday conversations. It's nice to read words of care about this aspect ❤️‍🩹. [1]: https://arxiv.org/abs/2601.20245 [2]: https://arxiv.org/abs/2604.04721

arXiv.org

How AI Impacts Skill Formation

AI assistance produces significant productivity gains across professional domains, particularly for novice workers. Yet how this assistance affects the development of skills required to effectively supervise AI remains unclear. Novice workers who rely heavily on AI to complete unfamiliar tasks may compromise their own skill acquisition in the process. We conduct randomized experiments to study how developers gained mastery of a new asynchronous programming library with and without the assistance

0

Fiona @mushu@social.troll.academy

· 5mo ago

Replying to

@tvluke ich denke Prag macht das ähnlich. Fand ich eigentlich für den Fluss von Menschenmengen ganz clever, wenn es erlaubt, die Bewegungen zu segmentieren.

0

1

0

Fiona @mushu@social.troll.academy

· 4mo ago

Time to queue 'Terran Theme 1' and build some slides.

0

Fiona @mushu@social.troll.academy

· 8mo ago

Replying to

@uint8_t@chaos.social might've been this: https://social.troll.academy/@mushu/115941118741449240

social.troll.academy

0