Blockchain security analysts have identified a new, highly dangerous phishing campaign targeting Web3 developers. Attackers are using sophisticated social engineering, posing as recruiters on the professional platform LinkedIn.
The attack scheme is as follows: a potential victim actively seeking a job in the crypto industry receives an offer to complete a test assignment. As a link to the assignment, the attacker sends a GitHub repository that initially appears to be a legitimate project.
However, malicious code is hidden inside this repository. Researchers discovered a Node.js loader cleverly disguised as a regular plugin for Tailwind CSS. When the developer, trusting the link, downloads and runs the code, the malware activates.
The functionality of this trojan is extremely extensive. It doesn't just steal data—it gains full control over the victim's system. The malware is capable of:
- Stealing personal information, including files and documents from the desktop.
- Extracting cryptocurrency wallet data, including private keys and seed phrases that may be stored in the browser or local files.
- Monitoring the clipboard, replacing wallet addresses when transactions are sent.
- Executing remote commands, allowing the attacker to fully control the infected machine.
This campaign poses a serious threat to the entire ecosystem. Developers are a key link in the security of blockchain projects, and compromising their machines could lead to large-scale attacks on protocols and code leaks.
Expert opinion: This incident confirms that phishing has moved to a fundamentally new level. Attackers are no longer sending mass emails with suspicious links. Now they invest time in personalized attacks, using the trust that arises during the hiring process. Developers must exercise extreme caution when working with any external repositories, even if they come from a "recruiter" with an impeccable profile. Checking code in an isolated environment is not paranoia, but basic security hygiene in 2024.