Phish or Legit?
Free security awareness trainer

Spot the scam before you run the code.

Phish or Legit? drops you into realistic recruiter DMs, take-home repos, emails, and texts. Make the call, see the red flags you missed, and build the instinct that keeps your keys and wallets safe.

Get started for free See how it works
  • About 10 minutes
  • Free account, no card
  • Nothing runs on your machine
  • Fake recruiter DMs
  • Poisoned take-home repos
  • Sneaky postinstall scripts
  • Install our meeting app
  • Your parcel is on hold SMS
  • Urgent invoice emails
  • Look-alike login links
  • Typo-squatted packages
The new phishing

The job interview is the delivery. The coding test is the malware.

Classic phishing training teaches you to avoid bad links. It does not teach an engineer that running a stranger's take-home repo can drain a wallet or a whole company. Smart people get caught by this every week.

Contact

A friendly recruiter or CTO messages you on LinkedIn, Telegram, or a job board, often borrowing a real company name.

Credibility

A calendar invite, a video call with HR, a polished profile, and a remote role that pays very well.

The task

You get a take-home repo with a clean README, or a request to install a video call tool or a driver fix.

Execution

Running npm install or starting the app triggers hidden code in a dependency or setup script.

Theft

Malware lifts browser passwords, wallets, SSH keys, and cloud credentials, then leaves a backdoor.

Why it matters

A real attack pattern, at real scale

Recruitment scams aimed at developers are now one of the most profitable ways into a company.

$6.43B

Reported loss after a Binance engineer ran an "assignment" repo from a fake second-round interview.

Source: The Hacker News

338+

Malicious npm packages tied to the Contagious Interview campaign, with more than 50,000 downloads.

Source: Socket

$501M

US job scam losses reported in 2024, up from $90 million in 2020.

Source: FTC

~$2B

Crypto stolen by North Korean groups in 2025, about 60% of all crypto theft that year.

Source: Chainalysis via PC Gamer
How it works

Learn by doing, not by reading a policy

Each round takes seconds. The lesson sticks because you made the call yourself.

  • See a realistic scenario

    A LinkedIn DM, an email, an SMS, a repo page, or a URL, rendered the way it would really appear.

  • Call it: Phish or Legit

    Trust your gut. Some are genuine, so you learn to tell the difference instead of distrusting everything.

  • Get instant feedback

    The red flags are highlighted in place, with a one-line rule to remember and a score at the end.

Message previewScenario sample

Dana Kerr

Head of Talent at Nebulachain Labs

Hi! Loved your GitHub. We're hiring a Senior Web3 Engineer, fully remote, $220k plus tokens.

To fast-track you, please clone our test repo from bitbucket.org/nebula-hr-tests and run npm install before our call today.

Two tracks

Built for developers. Useful for everyone.

Start where the risk is highest for you, then try the other track.

Primary track

Developer and job seeker scams

For engineers who hold wallets, keys, or deploy access, and anyone hunting for their next role.

  • Fake recruiter DMs and interview invites
  • Take-home repos with hidden install scripts
  • "Install this meeting app" and driver fix requests
  • Typo-squatted packages and look-alike orgs
Everyday track

Everyday phishing

For anyone with an inbox and a phone. Share it with family, friends, and teammates.

  • Bank, delivery, and tax SMS messages
  • Invoice and password reset emails
  • Look-alike login pages and short links
  • Genuine messages, so you learn what safe looks like
Safe habits

Six habits that beat most of these scams

Short, practical rules from the scenarios. Screenshot them for your next job hunt.

  • Run take-homes in a throwaway box. A fresh VM or container with no wallets, keys, or company logins on it.
  • Read package.json before npm install. Look at preinstall and postinstall scripts and anything that downloads or evals code.
  • Verify the recruiter yourself. Find the company careers page on your own and contact them there, not through the DM.
  • Treat "install our meeting tool" as a red flag. Real companies use mainstream video apps that run in the browser.
  • Slow down when it feels urgent. Deadlines, account locks, and too-good offers are designed to skip your judgement.
  • Check the real domain, every time. Read the address from right to left. Look-alike letters and extra words are the trick.
FAQ

Questions, answered

Is it really free?
Yes. Create a free account with just an email and you get the quiz, every learning room and lab, and Breach Night. No paywall, no card.
Will anything run or download on my computer?
No. Every scenario is a safe, fictional replica. Code samples are inert text and links are defanged, so nothing executes and nothing leaves your browser.
Who is it for?
Developers and job seekers first, because they are the most targeted by fake recruiter scams. The everyday phishing track covers emails, texts, and links that anyone can receive.
How long does the quiz take?
About ten minutes for all 22 scenarios, or less if you pick one track. You get instant feedback on each one and a summary of the lessons at the end.
Are the companies and people real?
No. All brands, names, and messages are invented. They are modelled on real attack patterns so the warning signs carry over to real life.
Can I suggest a scam I received?
Please do. Send it through the contact page with any personal details removed, and we may turn it into a new scenario.
Ten minutes, 22 scenarios

Think you would spot it?

Find out now, while the stakes are zero. Then send it to the developer friend who is job hunting.

Get started for free

All scenarios are fictional. No real brands, people, or working malicious code.

Phish or Legit? Spot the scam before you run it