Freelancers, a critical warning for your online safety. Recently, a suspicious job invitation on Upwork, deceptively titled ‘Experienced Node.js Coder Needed for Bug Fix’ with an enticing $760 payout, revealed itself to be a sophisticated malware attempt. This incident highlights the urgent need for vigilance when accepting projects, even on seemingly trusted platforms.

Initial red flags were subtle but crucial: an unusually high fixed price for what appeared to be a minor bug fix, an insistence on immediately downloading and executing a provided ZIP file to ‘diagnose the error,’ and a client profile that was brand new and lacked payment verification. These inconsistencies immediately raised concerns.

Instead of complying with the request to run the code, a closer inspection of the archived files, without execution, exposed the true nature of the ‘bug fix.’ Within the ZIP, a file disguised as a CSS helper (node/helpers/css.js) was designed to read a seemingly benign ‘CSS’ file (public/css/types.txt). However, this ‘CSS’ file was, in reality, heavily obfuscated JavaScript. Crucially, this script would only execute via eval() on Windows systems.

Further analysis uncovered a complex scheme: the obfuscated JavaScript was programmed to extract hidden ZIP archives (named js.zip, node.zip, and i.zip) and then silently launch Windows executables using cmd.exe /c start. Alarmingly, the project even included its own 7-Zip binary to facilitate the unpacking of these hidden malicious files locally. This intricate pattern of obfuscation, hidden archives, and the silent launch of executables is a hallmark of dropper and backdoor malware.

This incident was promptly reported to Upwork’s Trust & Safety team to protect other freelancers.

Key Safety Measures for Freelancers:

• Never Blindly Run Code: Always exercise extreme caution. Thoroughly inspect any code provided by a client before execution, especially if it’s from an unfamiliar source or platform.
• Recognize Red Flags: Be wary of job offers with unrealistic budgets for simple tasks, immediate pressure to download and run files, or client profiles that are new, unverified, or have limited history.
• Trust Your Instincts: If a job offer ‘feels off,’ pause and investigate. It’s always better to be safe than sorry.
• Report Suspicious Activity: Actively report any fraudulent or malicious job postings to the platform’s support or security teams.

Staying informed and cautious is our best defense against evolving online threats. Let’s work together to maintain a secure freelancing environment.