We teach developers to say no to the wrong repo
Phish or Legit? is a free, interactive trainer for the scams that classic security awareness training misses: fake recruiters, booby-trapped coding tests, and the everyday phishing that still works on all of us.
Why this exists
Attackers now pose as recruiters to get developers to run malicious code on their own machines. The job interview is the delivery mechanism and the take-home test is the malware. Security researchers call the pattern Contagious Interview, and it is behind some of the largest thefts in recent memory.
Developers are trained to run code. It is literally the job. Job seekers are motivated and short on time. And there is no bad link to hover over, just a normal-looking repo with a clean README. That is why the usual "check the sender, do not click links" advice is not enough.
Our founder has personally received more than ten of these fake recruiter approaches. Phish or Legit is the tool we wished existed the first time: a place to practise on realistic, harmless replicas, so the real thing looks obvious when it arrives.
Safe habits for take-home tests
- Run any code you did not write in a throwaway VM or container with no wallets, SSH keys, or company logins.
- Read
package.jsonscripts (preinstall, postinstall) and any setup files before installing. - Verify the recruiter and role on the company's own careers page, contacting them there.
- Join interviews on mainstream video tools in your browser. Never install an app or run a command to join.
- Be suspicious of pay that is far above market, vague roles, and requests to move to Telegram or WhatsApp.
Every scenario is fictional
All companies, people, domains, and messages in the quiz are invented and modelled on real attack patterns. Domains use the reserved .example suffix, links are not clickable, and code samples are inert text that cannot run.
Sources
- Binance reveals how fake job interviews led to a $6.43 billion theft, The Hacker News, Nov 2026
- Contagious Interview campaign: 338 malicious npm packages, Socket, Oct 2025
- Contagious Interview gets an upgrade for 2026, OpenSourceMalware, Jan 2026
- A simple AI prompt saved a developer from this scam, The Register, Oct 2025
- New FTC data show a big jump in reported losses to fraud, FTC, Mar 2025
How we build the training
Real patterns, fictional details
Every scenario mirrors a real attack, rebuilt with invented brands and people so it is safe to share.
No victim blaming
Smart, careful people get caught by these scams. We teach the tells without the shame.
Safe by design
Nothing runs or downloads. Code samples are inert text and links are defanged.
Free and open to all
No paywall, just a free account. Security instincts should not depend on your employer's training budget.
From a quiz to an awareness platform
We are starting small and shipping fast. Here is the direction of travel.
Now
The phishing quiz, hands-on investigations where you break it, explain it, fix it, and prove it, rooms on the OWASP Web, API, and LLM Top 10 with simulated labs, XP and streaks, and Breach Night, a multiplayer social deduction game.
Next
More rooms and labs, beginner to advanced paths, community-submitted scenarios, and shareable score cards.
Later
Team challenges, multilingual training, and awareness programmes for companies, bootcamps, and communities.