Security experts have identified a new large-scale campaign targeting Web3 developers. Attackers are using fake job postings on LinkedIn to lure victims into a trap.
The attack scheme works as follows: hackers, posing as representatives of well-known crypto companies, contact developers through the professional network LinkedIn. During the correspondence, they offer to review the code of a "test project" and send a link to a GitHub repository. However, instead of legitimate code, a malicious file is hosted there.
The key element of the attack is a hidden Node.js loader, cleverly disguised as a Tailwind CSS plugin. After downloading and running, the malware gains full control over the system. It can steal personal data, files, information from cryptocurrency wallets, as well as execute remote commands and monitor clipboard contents. The latter function is particularly dangerous, as it allows intercepting wallet addresses when copied and replacing them with the attackers' addresses.
Of particular concern is that such attacks are becoming increasingly sophisticated. The use of trusted platforms like LinkedIn and GitHub to distribute malware significantly complicates early threat detection. Developers, accustomed to working with open-source code and test projects, are at heightened risk.
Expert opinion: This campaign is yet another reminder that the crypto industry faces attacks targeting the human factor, rather than vulnerabilities in code. Developers should implement strict verification protocols for any external repositories, especially if the link comes from an unfamiliar "recruiter." Two-factor authentication and isolated environments for code testing should become security standards.