Security experts from SlowMist have recorded a large-scale malicious campaign targeting Web3 developers. Attackers are using sophisticated social engineering, masquerading as recruiters on the LinkedIn platform.
The attack scheme is as follows: scammers contact potential victims, offering high-paying positions at crypto startups. During the correspondence, they send links to GitHub repositories with supposedly test projects to assess the candidate's skills. However, inside these repositories, a Node.js loader is hidden, skillfully disguised as a legitimate Tailwind plugin.
What does this malware do? After activation, it begins collecting sensitive data: personal information, files from the desktop, as well as keys and seed phrases from crypto wallets. Moreover, the loader is capable of executing remote commands and monitoring clipboard contents — this allows intercepting passwords and wallet addresses in real time.
Threat Analysis
This campaign demonstrates the growing vulnerability of the Web3 community to phishing attacks through job search platforms. Attackers understand perfectly that developers are accustomed to trusting GitHub repositories, especially if the link comes from a "representative" of a well-known company.
My professional advice: never run code from repositories obtained from unfamiliar "recruiters", even if the profile looks convincing. Always verify the authenticity of the offer through the company's official channels. Pay attention to strange dependencies in package.json — if there are disguised plugins with suspicious names, this is a sure sign of a trap.
Currently, SlowMist continues to monitor the situation, but developers should already be on alert. This attack is just the tip of the iceberg in a new wave of targeted cyber threats for the crypto industry.