Security experts from SlowMist have documented a new sophisticated campaign targeting Web3 developers. Attackers are using social engineering, posing as recruiters on the LinkedIn platform, to lure victims into a trap.
The attack scheme unfolds as follows: fake "employers" contact developers, offering positions in promising blockchain projects. During the correspondence, they send links to GitHub repositories that supposedly contain test assignments or project descriptions. However, in reality, these repositories contain malicious code.
The key element of the attack is a hidden Node.js loader, cleverly disguised as a legitimate plugin for Tailwind CSS. This loader, embedded in project files, activates when the developer runs the code locally. Once activated, the malware gains full control over the victim's system.
The capabilities of this malware are impressive: it can steal personal files, cryptocurrency wallet data, intercept clipboard contents (critical for swapping transaction addresses), and execute remote commands, effectively turning the victim's computer into part of a botnet.
My professional opinion: This attack is a stark example of how cybercriminals are adapting to the realities of the labor market in the crypto industry. Developers, especially those working with DeFi and infrastructure projects, need to exercise extreme caution. Before running any code from third-party repositories, a thorough audit should be conducted in an isolated environment. The fact that the malware is disguised as such a popular tool as Tailwind speaks to the high level of preparation by the attackers and their deep understanding of the developer ecosystem.