My colleagues from the SlowMist team have detected a new targeted attack on Web3 developers. This time, attackers are using high-level social engineering, disguising themselves as recruiters on LinkedIn.
The scheme is as follows: fake "employers" reach out to job seekers, offering positions in reputable projects, and send links to GitHub repositories supposedly containing test assignments. However, instead of legitimate code, these repositories contain a trojanized Node.js loader, cleverly disguised as a plugin for Tailwind CSS.
As soon as a developer clones the repository and runs the code, the malware activates. It is capable of:
- Extracting personal data and files from the device;
- Stealing the contents of cryptocurrency wallets;
- Executing remote commands on behalf of the attacker;
- Monitoring the clipboard, intercepting copied addresses and private keys.
This is not just phishing—it is a multi-layered attack targeting the most trusting and active members of the ecosystem. Attackers are well aware that developers often work with multiple wallets and have access to sensitive infrastructure.
My expert assessment: This campaign is a vivid example of how cybercriminals are adapting to the modern realities of Web3. Using LinkedIn as an entry point and GitHub as an infection vector makes the attack nearly indistinguishable from a normal hiring process. I strongly recommend developers to check any third-party repositories through isolated environments and never run unsigned code from unfamiliar "recruiters." Vigilance and cold analysis are the only defense in this new wave of attacks.