SlowMist's analytical department has detected a large-scale malicious operation targeting developers in the Web3 ecosystem. The attackers used social engineering tactics, posing as recruiters on the LinkedIn platform.
The attack scheme is as follows: victims seeking jobs in the crypto industry are offered to complete a test assignment or review a project. To do this, they are redirected to GitHub repositories containing fake applications. Inside the code, a Node.js loader is hidden, skillfully disguised as a legitimate Tailwind CSS plugin.
Once the developer runs the malicious code, a multifunctional stealer is downloaded to their device. This tool is capable of:
- Stealing personal data, files, and access keys to cryptocurrency wallets.
- Executing remote commands on the infected machine.
- Monitoring clipboard contents — this is especially dangerous as it allows intercepting wallet addresses when sending transactions.
Expert analysis: This campaign demonstrates the evolution of attacks on Web3 developers. Using GitHub as a malware delivery vector is not new, but disguising as LinkedIn recruiters adds an element of trust. My recommendation to developers: never run code from repositories obtained from unknown "recruiters" without thorough verification. Always check the commit history and the contents of package.json. It is best to isolate such projects in a sandbox or on a virtual machine. In the current market conditions, where demand for crypto specialists is high, attackers will only refine such schemes.