Security experts have recorded a large-scale targeted attack on Web3 developers, using social engineering techniques and fake job offers. The attackers, posing as recruiters on the professional network LinkedIn, actively sent victims links to GitHub repositories supposedly containing test projects.
Inside these repositories, a dangerous Node.js loader was hidden, disguised as a legitimate plugin for Tailwind CSS. This malicious code not only infiltrated the system but also performed a wide range of espionage functions: stealing personal data, files, cryptocurrency wallets, as well as monitoring the clipboard and enabling remote command execution.
The campaign is specifically aimed at Web3 specialists, as they often have access to high-value assets and private keys. The attack exploits trust in recruitment processes, making it particularly dangerous. Developers need to exercise heightened vigilance when clicking links from unknown "recruiters" and carefully check code from any suspicious repositories.
Analytical commentary: This is yet another confirmation that phishing and social engineering remain the main attack vectors in the crypto industry. Attackers adapt to the behavior of professionals, using their familiar tools and communication channels. I recommend that all developers implement mandatory code verification in an isolated environment before execution, as well as use hardware wallets for key storage to minimize risks in the event of a workstation compromise.