Recently, cybercriminals have increasingly targeted Web3 developers, using social engineering and fake job offers. My analysis shows that this is not just an isolated incident but part of a systemic campaign aimed at stealing sensitive data and crypto assets.
The attackers operate through the professional network LinkedIn, posing as recruiters. They offer developers work on supposedly real projects and send links to GitHub repositories. These repositories contain fake projects with a hidden Node.js loader embedded. The malware is disguised as a legitimate Tailwind plugin, making it difficult to detect during a quick code review.
How the malware works and why it is dangerous
Once launched, the loader performs several critical functions: it steals personal data, files from the victim's computer, and information about cryptocurrency wallets. Additionally, the malware can execute remote commands and monitor clipboard contents. This allows attackers to intercept wallet addresses and replace them with their own — a classic address substitution attack during transaction submissions.
Particularly alarming is the fact that the victims are developers who, by nature of their profession, have access to private keys, seed phrases, and confidential smart contracts. The loss of such data can lead to complete project compromise and financial losses amounting to millions of dollars.
My expert assessment: This campaign demonstrates the evolution of attacks on the crypto community. Instead of mass phishing emails, attackers are shifting to targeted, carefully planned operations through professional networks. Developers need to implement strict verification protocols for any links and files received from potential employers, as well as use isolated environments for testing third-party code.