Upwork Job Post Uses Fake Attachment to Deliver Malware
A reported job listing on Upwork attempted to infect freelancers via a disguised VBS script inside a RAR archive.
The short versionA community report describes an Upwork job post that required opening an attachment to view requirements. The RAR file contained a VBS script that silently downloads and runs an executable. Freelancers are warned to avoid interacting with suspicious attachments and to flag such listings immediately.
What changed
- A job post from qualzynconstruction.com.au reportedly instructed freelancers to open an attachment before submitting proposals.
- The attached .rar file contained a .vbs file disguised as 'Requirements and Budget' that downloads and executes malware.
- The post was flagged as inappropriate by a community member and multiple job IDs were reportedly associated with the same threat.
What it means for freelancers
- Freelancers who open attachments without verification risk system compromise and data theft.
- Scammers are exploiting urgency and financial pressure to lower freelancers' guard.
- One compromised account can lead to identity fraud or loss of Upwork profile access.
What to do now
- Never open attachments or run scripts from unverified clients; request all details in the Upwork message center.
- Flag suspicious posts immediately using the 'Flag as inappropriate' link and report to Upwork Trust & Safety.
- If you opened a suspicious file, disconnect from the network, run a full antivirus scan, and change all passwords.
- Use a service like SnipeWork that scans Upwork via the official API and alerts you to new jobs so you can avoid risky listings.
Live market context — Jul 20 – Jul 26, 2026
19,223jobs scanned this week
$714avg fixed budget
$23/hravg hourly rate
Source: SnipeWork Upwork Market Index — weekly data from live Upwork job posts.
Stop refreshing. Start sniping.
SnipeWork scans Upwork every minute and pings your Telegram with matching jobs + an AI proposal draft.
Based on reporting by r/Upwork (July 27, 2026). Analysis is SnipeWork's own; we do not reproduce source text. Spotted an error? Tell us at hello@snipework.com and we will correct it.