Crypto news

SlowMist analysts have identified a new targeted attack aimed exclusively at Web3 developers. The attackers employed sophisticated social engineering, posing as recruiters on the LinkedIn platform. They sent invitations for "test assignments" and links to GitHub repositories that supposedly contained projects to assess the candidate's skills.

In reality, these repositories were infected with hidden malicious code. The key element of the attack is a Node.js loader, cleverly disguised as a legitimate plugin for Tailwind CSS. Developers, eager to showcase their skills and complete the task, ran the code without suspecting the threat.

What does the malware do?

Once activated, the loader performed a range of destructive actions: stealing personal files, cryptocurrency wallet data, monitoring the clipboard (to swap addresses during transactions), and executing remote commands with full control over the victim's system. This is not just phishing — it is a full-fledged backdoor aimed at stealing seed phrases and private keys.

What makes this campaign particularly dangerous is its narrow focus. Web3 developers are the most valuable targets, as they often have access to project private keys, test networks, and large sums in DeFi. The attack via fake recruitment is a classic but effective technique that works flawlessly in the crypto industry due to high competition for talent.

Expert comment from Cryptalist: This campaign is a stark reminder that in Web3, trust in "verified" platforms (GitHub, LinkedIn) should not be blind. Developers need to implement strict code verification procedures before execution, even if the code came from an "HR specialist at a major company." Use isolated environments (sandboxes) for test assignments and never run unfamiliar scripts on your main system. The industry must collectively raise its security culture, otherwise the next victim could be an entire protocol.