The analytical team I work closely with has identified a new sophisticated campaign targeting Web3 developers. Attackers are using LinkedIn to create fake job postings, with GitHub repositories as bait.
The scheme is simple but dangerous: fake recruiters contact job seekers via LinkedIn and offer "test assignments" or invite them to "review a project." The link leads to a GitHub repository that looks like legitimate code. However, hidden inside the files is a Node.js loader disguised as a Tailwind CSS plugin.
This malware doesn't just sit idly on the system. It is active: it steals personal data, files, and — critically for us — information about crypto wallets. Additionally, the loader executes remote commands and monitors the clipboard, allowing it to intercept wallet addresses when copied.
What is particularly alarming is that the attack specifically targets Web3 professionals — those who work daily with private keys and smart contracts. Developers are accustomed to trusting GitHub and often do not check code from repositories for hidden loaders.
What does this mean for the industry?
We are witnessing how social engineering combined with technical camouflage is becoming a standard tool for cybercriminals. LinkedIn and GitHub are the "workhorses" of any developer, and they are precisely what is being exploited now.
My recommendation: never run or install dependencies from repositories obtained from unknown "recruiters." Manually review the code, use isolated environments for testing, and always verify the authenticity of links. In the current situation, losing a single wallet could cost an entire career.
This is not just a warning — it is a new level of threat for the entire ecosystem. Stay vigilant.