Analysts have identified a new large-scale malicious campaign targeting Web3 developers. In this attack, threat actors use the professional social network LinkedIn to find victims, posing as recruiters from well-known companies.
The attack scheme is as follows: fake recruiters contact developers, offering job vacancies or test assignments. During communication, they send links to GitHub repositories that supposedly contain projects to assess the candidate's skills. However, inside these repositories, malicious code is hidden — a Node.js loader skillfully disguised as a legitimate Tailwind CSS plugin.
Once the developer clones the repository and runs the code, the malware activates. Its functionality is extremely dangerous: it steals personal data, files from the workstation, and information from cryptocurrency wallets. Additionally, the malware can execute remote commands on the infected device and monitor clipboard contents, allowing it to intercept wallet addresses and passwords.
Particularly alarming is that the attack specifically targets Web3 specialists — a group that should, by definition, be most aware of cyber threats. The attackers exploit trust by using official hiring channels and a popular developer platform.
My expert assessment: This campaign demonstrates the evolution of cybercriminal tactics in the crypto sphere. The shift from simple phishing emails to complex social engineering attacks through professional networks and version control systems is a troubling signal for the entire community. Developers need to implement strict verification protocols for any external repositories and use isolated environments to execute code from untrusted sources. Vigilance and multi-factor protection are the only ways to counter such targeted attacks.