← All cases
- Source
- LinkedIn
- Submitted
- 16/07/2026
- Published
- 22/07/2026
- Verdict
- v2 · 04/09/2026
- Engine
- 5c766bbb4aa0
- JSON
- report.json
What it does
| Verdict | Elevated |
|---|
| Code | No repository code was examined |
|---|
| Conversation | 4 signals of a recruitment scam in the conversation: multiple reports, suspected breached profile, no project links, salary stated upfront |
|---|
This case presents a high risk of a recruitment scam, with evidence suggesting a sophisticated operation. Indicators point to threat actors, potentially linked to state-sponsored groups, leveraging fake LinkedIn job offers and automated AI to distribute malware through a repository named AmonixPlay. The absence of project links and a salary stated upfront are common tactics in such scams. Furthermore, the presence of multiple reports and a suspected breached profile strengthen the assessment. The recurring pattern of "no project links" seen in past hijacked cases, particularly one with an unknown project brand, further calibrates this assessment, suggesting a deliberate attempt to obscure legitimate company information. The overall confidence in this high-risk verdict is moderate.
Conversation
Subject ДШ-9d6e
The AmonixPlay repository (associated with A5 Labs or a5-co) is an active malware and job recruitment scam. Threat actors—linked to state-sponsored groups—use fake LinkedIn job offers and automated AI video calls to lure software engineers into downloading the repository.How the Scam WorksThe Lure: Scammers pose as recruiters offering lucrative developer positions (often via automated AI interviews).The Trap: Candidates are asked to clone the AmonixPlay GitHub repository to complete an "interview assessment".The Exploit: Running the installation scripts executes malicious code that extracts all environment variables (like AWS keys, OpenAI API keys, and GitHub tokens) from the victim's shell, sending them directly to the scammers.[REPORTER] & Immediate ActionsDO NOT CLONE or run any code from the AmonixPlay repository.
Signals
| Signal | What it means | Severity | Found by |
|---|
| multiple reports | entity_overlap_with_prior_cases | medium | the engine |
| suspected breached profile | Reporter suspects the profile was compromised or stolen | medium | the submitter |
| no project links | No website or social links provided for the project | medium | the submitter |
| salary stated upfront | High salary offered before any vetting — common LinkedIn bait | medium | the submitter |
What to do
- Do not run any code or installer this contact sends; check it here first.
- Verify the recruiter through the company's own careers page or a known employee, not through the link they gave you.
- Do not share credentials, seed phrases or remote access, whatever the reason given.
What we could not see
| Code | No repository code was examined; the verdict rests on the conversation. |
|---|
| Layers | every layer ran |
|---|
Versions
| Version | Date | Band | Engine | Stages |
|---|
| 2 | 04/09/2026 | Elevated | 5c766bbb4aa0 | engine |
| 1 | 22/07/2026 | Elevated | legacy-pre-g | engine |
Disclaimer: This report is based on community-submitted information and automated analysis. It does not constitute legal advice or a definitive determination of fraud. Named or described entities may contest this report — if you believe this case contains inaccurate information, you may submit a correction or appeal. RTIdx processes takedown and correction requests within 7 days.
