Security experts have identified a targeted malicious campaign aimed at developers in the Web3 ecosystem. The attackers pose as recruiters on the professional platform LinkedIn and offer candidates participation in projects hosted on GitHub.
During the attack, victims are sent links to repositories that supposedly contain legitimate projects. However, hidden within the code of these projects is a Node.js loader disguised as a popular Tailwind plugin. This loader acts as a multi-purpose tool for data theft and executing remote commands.
Once activated, the malware gains access to personal information, files, and—particularly dangerous for the crypto community—cryptocurrency wallet data. Additionally, the program can monitor the clipboard, allowing it to intercept wallet addresses and other sensitive data, as well as execute arbitrary commands on the infected device.
This tactic is especially dangerous because developers often trust links from potential employers and do not always check code for hidden loaders. The incident highlights the growing sophistication of attacks targeting blockchain specialists, where access to wallets and private keys is highly valuable to attackers.
Expert opinion: This case is a vivid example of how social engineering combines with technical vulnerabilities. Web3 developers should exercise heightened vigilance when interacting with job offers, especially if they require downloading code from untrusted repositories. Regular dependency auditing and the use of isolated environments for testing projects can be key defenses against such threats.