My analyst colleagues have detected a large-scale malicious campaign targeting Web3 developers. The attackers employed sophisticated social engineering, posing as recruiters on the LinkedIn platform. Victims were offered participation in fake projects and then sent links to GitHub repositories containing counterfeit codebases.
Attack Mechanism: Hidden Loader in Tailwind Wrapper
Inside these repositories was a Node.js loader, skillfully disguised as a legitimate Tailwind CSS plugin. This malicious code performed several critical functions: collecting personal information, stealing files and cryptocurrency wallet data, remote command execution, and clipboard monitoring.
Clipboard interception poses a particular danger—it allows attackers to replace wallet addresses during transactions, leading to direct financial losses. In effect, the attackers created a multifunctional tool for complete control over the developer's workstation.
Expert Opinion
In my view, this campaign demonstrates a worrying trend: cybercriminals are increasingly using trusted channels (LinkedIn, GitHub) to inject malware into the professional environment of developers. Web3 specialists should be extremely cautious about any collaboration offers, especially if they require cloning repositories with unknown plugins. I recommend verifying the authenticity of recruiters through alternative communication channels and running any third-party code in an isolated environment.