Kaspersky identifies malware framework targeting crypto investors

Original OkoBot infection chain. Source: Kaspersky
Separately, a new malware campaign is seeking to infiltrate the devices of Web3 developers via fake LinkedIn recruitment opportunities, according to SlowMist.
Attackers contact blockchain developers via LinkedIn, posing as Web3 recruiters. They then send fake GitHub repositories to victims, claiming they contained the minimum viable product that needed to be tried before the interview, the blockchain security company said in a Saturday report.
The workflow closely resembles a legitimate technical interview where developers pull code, install dependencies and launch a project, which makes it difficult to notice the attack, according to SlowMist.
Related: UK sentences 2 hackers tied to $115M crypto ransom scheme
The malware aims to deliver a complete “remote access trojan” that infects devices, enabling attackers to steal project keys, cloud credentials, or wallet extension data from these developers.
“This attack is not an isolated case,” wrote SlowMist, adding that recent incidents illustrate that “attackers are increasingly leveraging scenarios such as recruitment, code reviews and project collaborations to trick developers into actively running malicious repositories.”
The report came a day after SlowMist warned of a separate malware campaign targeting macOS users, aiming to steal their credentials and hijack their Telegram sessions to ultimately trick investors into entering their wallet recovery phrases through fake websites.
Magazine: Does Botanix’s failure prove Bitcoiners don’t care about DeFi?

Facts Only

Attackers contact blockchain developers on LinkedIn pretending to be Web3 recruiters. Attackers send fake GitHub repositories claiming they contain a minimum viable product for an interview. The workflow mimics a legitimate technical interview process where developers pull code, install dependencies, and launch a project. The malware delivers a remote access trojan to infect devices. This allows attackers to steal project keys, cloud credentials, or wallet extension data from developers. Recent incidents illustrate attackers leveraging recruitment, code reviews, and collaborations to trick developers into running malicious repositories.

Executive Summary

Malware is being deployed to infiltrate Web3 developers through fraudulent LinkedIn recruitment. Attackers engage blockchain developers via LinkedIn, posing as recruiters and distributing fake GitHub repositories claiming to contain minimum viable products necessary for an interview. This process mimics a legitimate technical interview workflow where developers pull code and launch projects, obscuring the malicious activity. The malware installed on devices functions as a remote access trojan designed to steal sensitive information such as project keys, cloud credentials, or wallet extension data from the developers. Related incidents indicate that attackers are increasingly using scenarios like recruitment, code reviews, and collaborations to trick developers into executing malicious repositories. A separate campaign targets macOS users to steal credentials and hijack communications, aiming to lead investors toward entering wallet recovery phrases via fake websites.

Full Take

The pattern observed involves weaponizing established professional collaboration channels—recruitment, code review, and project collaboration—to normalize the execution of high-risk actions by developers. The method relies on mimicking legitimate workflow steps (pulling code, installing dependencies) to create plausible deniability for the malicious payload. This suggests a shift from direct phishing to environment compromise through trust exploitation within the developer ecosystem. The broader context indicates that attackers are leveraging scenarios of professional interaction as vectors for persistence and data exfiltration, moving beyond simple credential theft to targeting assets like project keys and wallet data. This pattern implies a systemic vulnerability in the security assumptions built into collaborative development practices. The implication is that operational security must extend beyond application-level defense to encompass the integrity of the entire developer lifecycle narrative. What safeguards are necessary when trust is deliberately manufactured across seemingly legitimate professional interactions?