The Fake Interview
A narrative threat-hunting podcast about how fake technical interviews became a global developer compromise pipeline.
From Red Asgard's Hunting Lazarus investigation: malicious coding tests, fake recruiter personas, developer credential theft, operator infrastructure, and the evidence trail left behind.
Start here
The show is sequenced. Start from Episode 1 and follow the investigation forward.
Real Blood on the Wire
The victim data that ended the honeypot theory. How a fake job interview became an execution environment, and why developer workstations were the real target.
The Repository That Called Home
How a fake coding test turned a developer machine into evidence. The attack path from plausible recruiter contact to remote code execution on a working developer's laptop.
The Factory
Five machines in the victim database were not victims. They were operator workstations. How the same pipeline that harvested developer machines also exposed parts of its own operators.
Eleven Hours
A contested forensic window. Researchers changed the password. Minutes later, the operator appeared to return through a separate path and changed it again. What can a live adversary machine reveal when both sides have touched it before preservation is complete?
Who this is for
Why this investigation matters
Fake interview campaigns do not only compromise individual developers.
A developer workstation can hold source-code access, cloud sessions, package registry tokens, wallet material, CI/CD credentials, and production-adjacent secrets. Compromise the developer, and the blast radius can extend into organizations the attacker never contacted directly.
What we do not publish
The podcast and companion notes intentionally avoid victim records, live credentials, active endpoints, reusable access paths, and exploit walkthrough details.
The goal is to explain the investigation and defensive lessons without turning the research into an instruction manual.
Companion notes
Per-episode technical notes published alongside the audio. Public-safe references, indicators, and reading lists — no operational detail.
Where to listen
Prefer your own podcast app? The hub above exposes a standard RSS feed for Overcast, Pocket Casts, AntennaPod, and anything else that speaks RSS.
Related written research
The podcast is based on Red Asgard's Hunting Lazarus research series on DPRK-linked, Lazarus-attributed fake interview campaigns targeting developers. The consolidated reference is the Inside the Machine research article.
For researchers, journalists, and newsletter editors
Public-safe references, episode notes, citation requests, or interview availability:
[email protected]