Anatomy of a LinkedIn "fake job" malware drop: the DeFi_share.zip git-hook trap

A LinkedIn “recruiter” pitching an AI-DeFi job sent me a project archive ( DeFi_share.zip ). The archive contains a git repository in which every working-tree file is truncated to zero bytes and a .git&#x2F;hooks&#x2F;post-checkout script is planted. Anyone who tries to “fix” the apparently broken checkout with git checkout . or git switch dev automatically executes the hook, which pipes a remote…