133: I'm the Real Connor

0:00I remember this one time I really botched a job interview. I was young, in my early 20s, and I applied to do surveillance at a casino. You know, the eye in the sky, watch 20 monitor screens at once and try to find someone cheating or stealing things in the casino, and then call the security guards on them. Well, I got an interview with the head of casino security, and things were going well. We hit it off, and he liked my resume, but then he asked me one last question. If you saw me stealing in the casino, would you turn me in? Now I was dumbfounded by this question. What is this, some kind of ethics test?

0:42I mean, he's the head of security. If I saw him stealing, who would I even report it to? I was baffled on how to answer this. But I wanted this job bad. And so I did a whole bunch of mental gymnastics to try to read his face and see what answer he wanted. I mean, the first thing that popped into my mind was that quote from the Cottonfather. Here, listen. You're my older brother, and I love you. But don't ever take sides with anyone against the family again. Don't take sides against the family. Who do you think started the whole casino business? It was mobsters. So what did this head of security cherish more?

1:22Family or the law? It's an impossible thing to answer. I felt as if I was on the poker table, going head to head with him, trying to read what cards he was holding. And my job was what was on the line. Well, I blurted out, Of course I wouldn't turn you in. You're my boss. And with that, he stood up and said, Thanks for coming in, but we're looking for someone else. Good luck. And he reached out to shake my hand. I quickly realized my mistake. Taking the family side was the wrong answer. It's the definition of corruption. Even if he wanted me to always protect the family, this was just too soon of a test to ask me something like that.

2:04I wasn't part of the family yet. Siding with him was taking sides against the casino itself. And if he was actually corrupt, he wouldn't show his cards like that so early in the first interview with someone. So I reversed my position. I shouted, no, no, no, I would definitely turn you in. The casino is who I work for, not you. He smiled and shook his head and walked me to the door and said, Better luck next time, kid.

2:34These are true stories from the dark side of the internet.

2:41I'm Jack Recider. This is Darknet Diaries.

3:01This episode is sponsored by my friends at Black Hills Information Security. Black Hills has earned the trust of the cybersecurity industry since John Strand founded it in 2008. Through their anti-siphon training program, they teach you how to think like an attacker. From SOC analyst skills to how to defend your network with traps and deception, it's hands-on practical training built for defenders who want to level up. Black Hills loves to share their knowledge through webcasts, blogs, zines, comics, and training courses, all designed by hackers, for hackers. But do you need someone to do a penetration test to see where your defenses stand?

3:35Or are you looking for 24-7 monitoring from their active SOC team? Or maybe you're ready for continuous pentesting, where testing never stops and your systems stay battle-ready all the time. Well, they can help you with all of that. They've even made a card game. It's called Backdoors and Breaches. The idea is simple. It teaches people cybersecurity while they play. Companies use it to stress test their defenses. Teachers use it in the classroom to train the next generation. And if you're curious, there's a free version online that you can try right now. And this fall, they're launching a brand new competitive edition of Backdoors and Breaches where you and your friends can go head to head hacking and defending just like the real thing.

4:11Check it all out at blackhillsinfosec.com slash darknet. That's BlackHillsInfosec.com slash Darknet.

4:45resilience is more important than ever. With Cohesity, you can secure and protect your company's entire data estate with a single platform, reduce your risk from threat actors, and quickly respond and recover from destructive cyber attacks. Cohesity's protection is comprehensive, proactive threat detection and classification with multiple feeds, AI ML zero-day detection, and 230-plus patterns across 12-plus global regulations. And most importantly, Cohesity is reliable. They provide some of the fastest possible restores, rapidly recovering thousands of VMs backed by immutable, strictly consistent data copies.

5:19This is why Cohesity is trusted by 70 % of the global 500. Discover how leaders stay resilient at Cohesity.com slash resilience everywhere. That's Cohesity, spelled C-O-H-E-S-I-T-Y. Cohesity.com slash resilience everywhere.

5:40So let's start out with who you are. What do you do? Yeah, so I'm Connor Tumbleson. I'm just kind of, you know, an engineer here in Tampa. Kind of really gone up the steps over the years. I think I'm our director of engineering now, so I kind of just really do a lot of tech stuff. The main thing to know about Connor is he spent years in the tech industry. He's a great programmer, which has led him to become a director of engineering. And he's content in his current role. He's definitely not job-seeking. However, his resume is pretty nice, and he's got a whole list of skills under his belt, and he has a great GitHub.

6:15GitHub is a place where people go to share programming code they made, and Connor has wrote a lot of code. So Connor has published a lot of this code to GitHub for other people to see. If you go there, you can see what code he's been writing since 2011. In fact, he's posted new code 51 ,000 times over the last 12 years. And what's interesting about GitHub is you can go back through those years and see every line of code that he shared and what date he shared it. Okay, September 14th, 2022, you get an email. Yeah, I mean, it's crazy. I'm sitting at lunch, you know, and your phone goes off and I get just one of those weird subject titles that I think is just an easily deletable one.

6:56I think it word for word was something like, Connor, your identity is stolen. It does have a spammy taste to it, doesn't it? I think I've probably gotten spam like this before. You know, click here to see if my identity is stolen. And I was just like, yeah, this is probably spam because it came from kind of an address I didn't recognize. It looked like a bunch of kind of foreign characters I didn't recognize. And I was like, all right, this is a delete. But then before I deleted it, I saw it had an attachment. I was like, okay, I'm on my phone. This is, I think, probably an easy preview, especially since it was kind of a suspect email.

7:30But, you know, thankfully I could just preview it, and I previewed it and it was like my resume, but it wasn't. And I was like, this is really odd. The email was from a guy named Andrew. And Andrew is also a programmer, but he's just starting out in college and has only posted a little bit to GitHub. Andrew said someone found him and messaged him on GitHub and offered him a job. But when Andrew asked more questions about the job, he was told he had to act like Connor to get the job. I kind of just quickly ate my lunch, you know, and kind of ran back to my computer and just jumped on to view it, you know, in Gmail.

8:08And at that point, when I expanded it for real, I saw it was way more than like my resume. It was like an introduction of me from like a, I was really rough reading it from very first inspection. Because it was like someone trying to pretend they were me. because not only was the email just clearly wrong, but the address was like an address that was for sale on Zillow, kind of right around where I live. Then it was my resume. Then it was like information about a company. And then it was information of like a fake cover letter I wrote. And at this point, I'm thinking, holy cow, what is going on here?

8:46Because now I think this is actually legitimate because there's someone that's put a great deal of effort into taking a lot of my true, you know, like earned achievements, whatever, school, everything, but then mixed it with a bunch of things that are lies, which I think, funny enough, boosted my resume in a way. But yeah, they weren't true. It was just a mixture of lies and truth in a huge document. Okay. Wow. They took Connor's real resume, but changed just a few things like the email address, physical address, and a few other accomplishments. But all this sounds really spooky. I mean, to get an email from someone explaining all this, the person sending the email could be trying to help or they could be trying to scam Connor into paying them to scrub this information off of some website or something.

9:33What was the real intention of this Andrew guy who emailed him? Yeah, so it was weird. He was telling me that there was this guy, Maris, and it's just a guy that was hiring him to be an engineer. And I was like, OK, what does that have to do with me? And then he says, like, you know, in the next sentence in the email, he's like, it turns out I was supposed to pretend to be you and I didn't feel comfortable with it and sent me the doc. So I read that. I read the doc. And I'm still thinking this is weird because, as you just mentioned, like I'm getting suspicious that the guy just wants me to sign into something, buy something.

10:10So I just sent a quick response. And I said, so to get this right, you were hired at a company and then paid to pretend to be me for an interview. And he responds and goes, yeah, I'm about to go to class, but here's a few log snippets of just a Slack channel. It seems like this guy Andrew is responding to questions Connor has, but is equally as confused as Connor is about this. I mean, imagine someone messages you on GitHub, offers you some paid work, and when you say, yeah, that sounds great, then they ask you to pretend to be someone else. So Andrew was sending more information over to Connor, screenshots of Slack chat that he had with this Marist person.

10:46And at this point, I'm actually just getting attached to this because in the screenshot he sends me, he's talking about the interview that's supposed to be in like a few hours time that I'm looking at of me that he is like, you know, no longer attending. And this is crazy because I'm also talking to a coworker next to me at this point. Like, should I join this interview? What is going on? Like, I feel like someone is pretending to be me in an interview later today. And that is kind of crazy to think about. Oh, right. This is an online video interview, and it's all set up where the company is expecting Connor to join and be interviewed.

11:25And it was in a few hours. This just gets wilder and wilder. Connor starts wondering if he should join the interview. And just to see what's going on, at the least he can inform this other company that they shouldn't hire him because he's not actually applying for the job. And that's going to be awkward to explain to them for sure. All the while, Connor is trying to figure out why they took his resume to copy. What was it about Connor that made his resume special? Yeah, and I think that's what really kind of really sketched me out or made me feel a bit uneasy. Because at the end of the day, I thought, why not just make some AI generator random document if you're trying to go out there and get jobs?

12:04Connor still feels like he needs more details from Andrew. Something just isn't adding up still. I'm trying to actually email him a lot. I'm saying like, hey, I need more info here. I dug deeper into this and it's more creepy than I thought. And I was like, hey, what more can you give me? Can you give me all your email communications? Can you tell me more? And he was like, sorry, I'm going to class. And I was like, oh, so the person that's helping me through this is like no longer available. How did Andrew get involved in this? He mentioned that he kind of just got cold emailed, like just a random email, presumably from his GitHub where someone reached out and said they were looking for a partner to join him and needed a bit of development experience.

12:42And this was a guy that was kind of a fresh developer right out of school that was looking for a kind of place to work and it seemed like a great chance. So I think he continued moving forward with his employment. As they said, they needed a good English speaking engineer. And he fed all those boxes. Andrew ends up joining this company. They get invited to a Slack channel. And the same day he joins a Slack channel, roughly a few hours later, he ends up getting just a bunch of messages. Now, when Andrew joined this Slack chat, he was greeted by someone just named PND. This PND person, his acronym, ends up posting to Andrew and says, hey, you're going to pretend to be this person.

13:25And it's a link to that document that he ends up linking or kind of sharing to me. And that's when Andrew realizes, I don't really want to be part of this because Connor looks like a kind of English speaking engineer. Why am I pretending to be him? And Maris, I mean, Maris or the PND, we don't really know who this person is, says, yeah, Connor is not our engineers. Is that going to be a problem for you? And he says, yeah, that violates his ethical kind of behavior. And Andrew just ends up leaving and taking a bunch of information with him. So I'm thinking to Andrew, this guy is amazing. Just leaked a bunch of information to me from this whole thing.

14:06and I guess lost a job in the process. Probably not the best job, but for someone looking for work, I guess a job was a job. Hmm. I wonder how big of a decision this was for Andrew. A college kid looking for work, finding a job that pays, but having to turn it down because it violates his ethics? I bet there are quite a lot of college kids that would be up for it, you know? And I wonder if this is a tactic, that this Marist person or PND person targets college kids because they need the experience and work and are more willing to take non-ethical jobs? I don't know. Anyway, for Connor to get an email like this, it absolutely derailed his ability to concentrate on anything at work that day.

14:49I mean, he had to go to an interview that he did not set up. And how do you even prepare for something like that? Actually, it doesn't matter, since there just wasn't much time to prepare for it anyway. Yep, exactly. So I think I opened it around noon, and the interview was at 4 or 4.30. So it was a pretty quick turnaround on all this. Andrew sent Connor all the information to join the interview. And it, of course, had the Zoom link and the time and the company and the meeting. And I was like, oh, this is crazy. I'm going to use this for sure. So then I join it. But I actually joined the interview about five minutes before it starts.

15:24And I'm just kind of sitting in a Zoom channel. You know, it's the Zoom waiting room. I can't really talk to anyone yet. I'm stuck there. And my fear is I'm sitting in this meeting and someone is going to join before me like another person. And then I'm stuck in kind of a debate. But thankfully, the interviewer, he shows up early and adds me. And we both jump on video, kind of sitting in the same spot I am now. And I say, hey, before we jump into interviews, you're not going to believe anything I'm going to tell you. So I'm going to go really quick. And I just proceed to tell this guy, and I think I just spew it out as quick as I can, of saying like, I didn't apply for this job, but I am indeed the person that you have all the documentation for.

16:07And he starts getting really confused here, trying to not follow what's going on. I think at first he thinks I'm pranking him. And I'm trying to explain, no, this is legitimate. I'm the real Connor, but I did not apply for this job. And he starts like joking with me, well, your resume is really good. We were hoping this was a real interview. And while we're talking, I'm trying to explain what happened from my perspective. That I got an email. I'm asking him, can you share from your perspective who applied for the job? And while we're talking about this, because he lets me know that it was on Upwork that my fake self applied for the job.

16:46Then he tells me that there's another Connor Tumbleson in the waiting room. And at this point, I'm kind of freaking out a bit. because now another fake Connor has decided to join the call and he's trapped in the meeting room. And this interview guy, he goes, hey, why don't you change your name, turn off your camera and just sit in this call? And I was like, holy cow, that is amazing. It was your idea. I love it. I want to sit here and figure out what's going on. So I changed my name. You know, I turn off my zoom camera and I'm sitting in the call when he admits another Connor Tumbleson. And this is where the story goes even crazier.

17:24As I then sit in a call and listen to a guy with kind of this accent that I can't place. I think I can safely say it's probably not American, but I don't know where. And this guy then proceeds to say that he's Connor Tumblson. And not only that, he starts reading off all my accomplishes. Even says his GitHub address, which is odd because I haven't changed my alias, online alias in like 20 years. So I bought peaches everywhere as me. So to hear someone say that, it was just extremely upsetting. And I'm just sitting in this call, listening to this guy proceed to just list things. I can tell he's reading the sheet word for word that I'm looking at.

18:03Man, I can't even imagine being in this scenario. Listening in on an interview with someone else pretending to be you, trying to get this job? What? All the time fake Connor is speaking, the real Connor is muted, listening. How does he respond to all this? How would you respond to this situation? If I were him, I'd be freaking out, wondering if I'm being pranked and wanting to know who this guy is that's pretending to be me and who put him up to this. Yep, definitely that. And I'm talking to some coworkers at the same time during this because we're just all sitting around because they're all at this point involved in the story.

18:38And I couldn't stay on mute any longer. It was just really, really rough. I thought I could sit there and just listen to information. but I turned my camera on and kind of just started talking and I said, hey, I'm the real Connor Tumbleson, so who are you? And I didn't get, I think, more than five, 10 words out of my mouth and he just dropped the call, which was pretty sad because I really wanted to figure out like if we could have just a candid conversation of why this was happening. But he left the call immediately. What was going through your mind after that interview? Just the fact that another Connor joined the call, a fake me, I was so confused because I was under the impression initially that this guy I was talking to, Andrew, had ended up joining the call and going forward with this.

19:22And I was like, why would he do that? He just leaked it all to me. I couldn't really figure out in my head how there was actually someone joining the call. So this PND person set up this interview and asked Andrew to join it and pretend to be Connor. Andrew said no for ethical reasons, but then someone else pretending to be Connor did join the call? Who was that person? Yep, exactly. So at that point, I'm kind of talking to the interviewer again because the other Connor has left the call. And I was like, hey, do you mind just sending me everything you have? And I was like asking for who applied, how did he apply, etc.

19:58And this guy goes, yeah, sure. Can I have your email address? And I was like, hey, just take the email they gave you and take the two off the end of it. Because like, it was such an embarrassingly copied email. It was just my email with a number two at the end. So sure enough, this company, they then email me and it's just screenshots of Upwork. And it's, this is where I got way more creeped out is it was a fake Upwork of me. And once again, it was a highly detailed resumes accomplishments. They even had like a random Laravel certification I got from a few years ago. And I didn't even put that on anywhere except in a tweet.

20:33So I was like, this is a crazy amount of detail that someone went to to make a real truthful, but also exaggerated in a lot of regards, Upwork account of me. Stay with us. There's more after the break.

20:53This episode of Darknet Diaries is brought to you by Flashpoint. 2025 has proven to be a pivotal year for security leaders. It's not just cyber threats anymore. Physical risks and geopolitical tensions are colliding, creating a web of challenges no one can afford to ignore. That's where Flashpoint comes in. As one of the largest private providers of threat intelligence, Flashpoint delivers what security teams need most, clarity. By combining cunning-edge technology with the expertise of world-class analyst teams, their Ignite platform gives organizations instant access to critical data, expertly analyzed insights, and real-time alerts, all in one seamless platform.

21:27From Fortune 500 companies to government agencies, Flashpoint is a name trusted to keep people, assets, and operations secure. To access some of the industry's best threat data and intelligence, visit flashpoint.io today. That's flashpoint.io.

21:50Okay, so let's recap. Someone made an Upwork profile using Connor's resume and information. and they were using that fake profile to apply for real jobs, then getting someone else to act like Connor for the job. Then that person would sit in an interview and pretend to be Connor. Yeah, so Upwork is a place that freelancers can go to look for jobs. Anything from design to IT or legal professionals, freelancers will make an account saying what skills they have and that they're available to work on these projects. And either someone messages the freelancer about a job or a job gets posted on Upwork and freelancers can apply for it.

22:28Someone made an Upwork account using Connor's details, some real, some fake, and applied for jobs saying, look how great my profile is. I want to come work for you. Yeah, and I think I honestly had never really used Upwork or only slightly heard of it myself at the time. So I was also Googling what is this thing? And yeah, just as you described, it seemed like it was just an ad hoc applying to a job as an individual using my fake information. So at this point, now that I have screenshots of my fake Upwork account, including my real photo that was like a recent work photo, I was like, okay, this is getting really crazy now.

23:07And I kind of thanked the interviewer for really letting me sit on the call. I said, thanks for this info and took all that info and then wrote another kind of large email to Andrew, where I kind of honestly asked him, was that you on the call? Because I really had no idea what was going on at this point because I couldn't really figure out how a third Connor joined the call. And Andrew, after he gets back from class, actually responds, and he gives me a ton of information. He not only sends me every email that he, you know, went back and forth with this Marist person to, like, establish this vacant appointment, but he also sends me screenshots of all these Slack channels where he only joined that day as, you know, part of joining this kind of paid work.