Security experts from SlowMist have identified a sophisticated malicious campaign targeting Web3 developers. The attackers used LinkedIn to create fake job postings, posing as recruiters, and sent candidates links to GitHub repositories containing counterfeit projects.
Inside these repositories, a Node.js loader was hidden, disguised as a legitimate Tailwind plugin. This malicious code had extensive capabilities: stealing personal data, files, and cryptocurrency wallet information, executing remote commands, and monitoring the clipboard. Particularly dangerous is the attackers' ability to intercept copied wallet addresses, allowing them to redirect transactions to their own accounts.
This attack demonstrates a growing trend of social engineering in the crypto industry. Hackers are increasingly exploiting developers' trust in professional platforms like LinkedIn and well-known tools (Tailwind) to inject malware. Instead of directly hacking code or networks, they target the hiring and development process itself.
Expert opinion: This campaign is a stark example of how attackers are adapting to modern work methods. Developers should exercise heightened vigilance: verify the authenticity of job offers, avoid running code from untrusted repositories, and use isolated environments for testing. The era of "trust but verify" in Web3 is fading—now it's time for "verify but don't trust."