By Tamara Levit in Upwork — Nov 11, 2025

Sure, Just Run This EXE. Scammers on Upwork.

Intro

Not every “bad client” is a scammer. A bad client can waste your time, push deadlines, or nitpick your work to death. Annoying? Yes. Dangerous? Usually not.

A scammer, on the other hand, isn’t here for your patience - they’re here for your files, access, accounts, or identity.

I'll describe some most popular cases.

Case 1: Malware campaign targeting developers

Image is taken from Reddit post about the same scam case.

I already saw it many times, but I'll keep it short: they are searching for a developer, then ask you to review the code first, but the repo has malicious code.

Why? Scammers do this because freelancers are a gateway. Developers often have access to code, cloud accounts, servers, internal tools, or crypto wallets. By infecting your machine, they can steal credentials, copy other projects, break into companies, resell access, or drain funds.

Case 2: Same stuff, but they are disputing you on Upwork

They are doing the same, but with their own project. If someone is saying you stole his project, don't panic first, analyse, did the client already pay you for anything?
Be careful, they can dispute you or blackmail you for the refund.

Once, I had a case when we won such a dispute. Please, fight.

Case 3. Phishing Files Disguised as “Project Materials”

Some scammers send what look like harmless project files or contract documents — usually .pdf, .zip, .exe, or even .scr renamed to appear like paperwork or design assets. The message sounds routine: “Please review the project files” or “Open the contract to start.” However, once the file is opened or executed, it silently installs malware.

Why? Classic viruses or stealing files.

Example from reddit https://www.reddit.com/r/Upwork/comments/14snwb5/a_client_account_sent_me_files_that_contain_a/?utm_source=chatgpt.com

Case 4. Stealing Your Upwork Account to Cash Out Later

In this scam, the goal is not your files, but your identity and access. Scammers try to get into your Upwork account by sending phishing links, fake “verification” forms, or malware that steals browser cookies and saved passwords. Once they gain access, they quietly change your recovery email or security settings and wait. The account may look untouched for days or weeks, until they suddenly move your earnings to their own payment methods.

Other cases:

They send you a bonus and ask you to buy something, then ‘return’ the bonus via bank transfer.
They ask you to buy in-game currencies, gift cards, casino credits, or top-ups.
They say they’ll pay you by check (classic check scam).
They ask you to move off Upwork (usually to Telegram or another messenger) right away
Require that you pay a fee in order to apply for a job.
Messages asking you to join a social media group or subscribe to a YouTube channel in order to receive a contract
Offer sent without a previous conversation, and not replying to any message before you accept

If you want to buuuuy me a coffee https://buymeacoffee.com/levit

UKRAINE! Webinar! 25.11! It will be about news on Upwork + HUGE QA

Come to see me and ask anything about Upwork. It's free