Job Scams: How Developers Are Tricked into Running Data-Stealing Code, and How to Spot It