Attack on Web3 Developers: SlowMist Exposes New GitHub Campaign with Fake Recruitment
SlowMist analysts have identified a new malicious campaign targeting developers in the Web3 space. Attackers are using fake job postings to gain the trust of professionals through professional networks such as LinkedIn.
The attack scheme is as follows: attackers, posing as recruiters, send candidates links to GitHub repositories containing fake projects. Inside these files, a Node.js loader is hidden, disguised as a legitimate Tailwind plugin. This malicious code not only steals personal data, files, and cryptocurrency wallet information but is also capable of executing remote commands and monitoring clipboard contents.
What makes this attack particularly dangerous is that it exploits trust in open repositories and professional platforms. Developers, accustomed to checking code before running it, may overlook the hidden loader if it is disguised as a popular tool. This makes the campaign extremely effective.
Expert comment: This incident highlights the growing sophistication of attacks on the Web3 community. Developers need to be extremely cautious when dealing with offers from unfamiliar recruiters and always check code for hidden dependencies, especially if files are obtained from untrusted sources. I recommend using isolated environments for testing any external projects.