
The Web3 sector often boasts offers that seem too good to be true – from investments in crypto tokens to play-to-earn games and job opportunities.
Recently, cybercriminals have been exploiting the trust of some cryptocurrency enthusiasts, tricking them into infecting their systems with info-stealing malware under the pretense of offering lucrative positions in the crypto industry.
Reports Indicate Hundreds of Victims
Sources indicate that the campaign has already affected hundreds of people, though the exact number remains unknown. The malicious campaign is allegedly orchestrated by a Russian threat actor group called "Crazy Evil." The gang`s modus operandi involves using social engineering techniques to deceive unsuspecting targets into installing info-stealing malware on their devices.
Once infected, the malware collects all data deemed useful by cybercriminals, focusing on cookies, credentials, and cryptocurrency wallets. Crazy Evil has gained notoriety for its previous malicious activities in the Web3 sphere, where it was observed running campaigns promoting fake job offers and fraudulent games among users in this space.
Cybercriminals Used a Fake Web3 Company Profile
Web3 professional Choy, who fell victim to the new fake job scam, told BleepingComputer that the threat actors created a sophisticated fake presence for a company named "ChainSeeker[.]io." The fraudulent entity had a website along with LinkedIn and X profiles to reinforce the illusion of legitimacy.
The scammers took it a step further by creating premium job listings on various popular platforms, targeting desirable positions such as social media manager, NFT artist, blockchain analyst, and marketing director.
Targets Redirected to Telegram
Job applicants received an email inviting them for an interview, instructing them to contact a "team member" via Telegram to schedule the meeting. Once in touch with the so-called team member, candidates were provided with a website, a code, and installation instructions for a specific application on their devices.
However, visiting the website and using the provided code triggered the download of rogue Windows or Mac clients loaded with info-stealing malware. Windows users received a combination of a remote access trojan (RAT) and an infostealer, while Mac users were infected with the notorious Atomic Stealer (AMOS) strain.
Campaign Ended, but Victims Remain at Risk
Following the exposure of the malicious campaign, cybercriminals reportedly ended it. The popular Web3 job listing site CryptoJobsList also removed fraudulent postings from its platform, warning previous applicants that they had fallen victim to the scam and advising them to scan their devices for malware.
Unfortunately, cryptocurrency scams continue to plague the digital world, with attackers constantly developing new, cunning techniques to target unsuspecting victims.
– While understanding how crypto scams work and their potential impact on you is crucial for defense, using specialized antivirus software can further enhance your protection – says Arkadiusz Kraszewski of Marken Systemy Antywirusowe, the Polish distributor of Bitdefender software. – With it, you can not only shield yourself from malware but also protect against the consequences of phishing campaigns.
COMMERCIAL BREAK
New articles in section Law in media
Dietary supplement ads in Poland. Who keeps influencers in check?
Newseria, KFi
One in three Polish internet users considers influencer recommendations when deciding on medicines and dietary supplements. Although promotion of such products is regulated, there are still cases of advertising that skirt the law.
SEO Poisoning. Hackers Use Search Engines to Target Businesses
Piotr Rozmiarek
Search engines help us quickly find information, but they can also be used by cybercriminals. SEO poisoning is a tactic where attackers manipulate search engine rankings to place harmful websites at the top of search results.
SLAPP Lawsuits in Europe. How Journalists and Activists Are Silenced
Krzysztof Fiedorek
The number of strategic lawsuits aimed at intimidating journalists, activists, and civil society organizations is increasing in Europe. According to the CASE SLAPPs Report 2024, as many as 1,049 such cases were identified between 2010 and 2023.
See articles on a similar topic:
Local Media in Poland - Workshop and Ethics
Bartłomiej Dwornik
Every day, journalists face the dilemma of whether to report on something or to omit it. Where does information end, and where does violation of privacy begin?
Cyber Attack on a Corporate Smartphone. How to Protect Yourself
KrzysztoF
Internet-connected mobile devices are an attractive target for cybercriminals. The key to protecting sensitive business data is employee awareness, hardware solutions, and appropriate software. This mini-guide provides a quick overview of how to protect each of these areas.
Illusory Security. Small and Medium Enterprises Easy Targets for Cybercrime
KF
35% of micro, small, and medium enterprises (SMEs) fear the theft of their employees' personal data. This comes from research conducted on behalf of ChronPESEL.pl and the National Debt Register of Poland.
Hate in the Polish Internet. IRCenter Study
Krzysztof Fiedorek
The proportion of hate speech victims is inversely proportional to the age of internet users. The study authors point out that this is directly influenced by the fact that older generations are instilled with the principles of respectful discussion and use the internet less frequently.