Cybercriminals are increasingly exploiting the job recruitment process to infiltrate cryptocurrency organizations. A recent incident involved a fraudulent Web3 job interview that led to the deployment of sophisticated malware, compromising sensitive data and assets.
The attack commenced when a recruiter contacted a potential candidate via LinkedIn, followed by scheduling interviews through Calendly. The candidate was then presented with a technical assessment in the form of a Google Sheet. However, this assessment redirected the individual to a signed Microsoft ClickOnce application—a deployment format typically perceived as trustworthy by Windows users.
Security analysts from Have I Been Squatted identified this campaign after a cryptocurrency organization suffered a breach in July 2026. The victim’s active job search made them a prime target, illustrating how attackers can craft personalized lures based on real-life career activities.
The fraudulent assessment utilized a Google Apps Script page that mimicked a legitimate Google-hosted workspace. It collected information about the visitor’s device and browser wallet extensions, then displayed a connector error message, prompting the user to install a purported Google API helper. The signed GapiUpdate.application package opened an authentic Google Workspace page within WebView2, making the process appear legitimate. Subsequently, it contacted the attacker’s infrastructure and downloaded a password-protected archive containing three files disguised as PNG images but were, in fact, Windows executables.
These executables delivered multiple malicious payloads, including NeedleStealer, a Rust-based information stealer, and a Go remote access trojan (RAT) with hidden virtual desktop capabilities. This multi-layered approach allows attackers to deploy various payloads without the need to sign new applications for each iteration.
NeedleStealer targeted browser credentials, sessions, cryptocurrency wallets, Telegram data, and captured screenshots. The Rust-based stealer expanded the scope by compromising password managers, VPN and SSH configurations, developer tools, and cloud settings. The Go RAT provided attackers with remote control over the infected system, enabling command execution, file browsing, keylogging, proxying, in-memory execution, persistence, and both visible and hidden Virtual Network Computing (VNC) sessions. Notably, hidden VNC allows attackers to operate a separate desktop session without the user’s knowledge, significantly escalating the risk and complexity of the breach.
This incident underscores a broader trend where cybercriminals leverage recruitment processes to deliver malware. Similar tactics have been observed in previous attacks targeting blockchain professionals, where fake recruiter schemes were used to deploy malicious software. Additionally, the abuse of ClickOnce installers for malware delivery has been documented, highlighting the need for heightened vigilance during software installations.
The presence of hidden access tools like the Go RAT necessitates comprehensive incident response measures. A compromised developer workstation should be treated as a potential exposure of all credentials, sessions, wallet keys, cloud tokens, source-control tokens, and deployment secrets accessible from that device. Simply removing the suspicious application is insufficient, as attackers may retain remote access through other means.
To mitigate such risks, organizations and individuals should independently verify the identities of recruiters through official company channels. Any interview-related software or code should be handled within separate, disposable environments to prevent potential system-wide compromises. This approach aligns with best practices for handling malicious interview coding challenges and other social engineering tactics employed by threat actors.
As cybercriminals continue to refine their methods, particularly targeting the cryptocurrency and Web3 sectors, it is imperative for professionals in these fields to exercise caution during recruitment processes. Implementing robust security protocols and maintaining a high level of skepticism towards unsolicited job offers can significantly reduce the risk of falling victim to such sophisticated attacks.
