Phishing in the Cryptocurrency Industry. Fake Recruitments Steal Data

illustration: DALL-E

The Web3 sector often boasts offers that seem too good to be true – from investments in crypto tokens to play-to-earn games and job opportunities.

Recently, cybercriminals have been exploiting the trust of some cryptocurrency enthusiasts, tricking them into infecting their systems with info-stealing malware under the pretense of offering lucrative positions in the crypto industry.

Reports Indicate Hundreds of Victims

Sources indicate that the campaign has already affected hundreds of people, though the exact number remains unknown. The malicious campaign is allegedly orchestrated by a Russian threat actor group called "Crazy Evil." The gang`s modus operandi involves using social engineering techniques to deceive unsuspecting targets into installing info-stealing malware on their devices.

Once infected, the malware collects all data deemed useful by cybercriminals, focusing on cookies, credentials, and cryptocurrency wallets. Crazy Evil has gained notoriety for its previous malicious activities in the Web3 sphere, where it was observed running campaigns promoting fake job offers and fraudulent games among users in this space.

Cybercriminals Used a Fake Web3 Company Profile

Web3 professional Choy, who fell victim to the new fake job scam, told BleepingComputer that the threat actors created a sophisticated fake presence for a company named "ChainSeeker[.]io." The fraudulent entity had a website along with LinkedIn and X profiles to reinforce the illusion of legitimacy.


The scammers took it a step further by creating premium job listings on various popular platforms, targeting desirable positions such as social media manager, NFT artist, blockchain analyst, and marketing director.

Targets Redirected to Telegram

Job applicants received an email inviting them for an interview, instructing them to contact a "team member" via Telegram to schedule the meeting. Once in touch with the so-called team member, candidates were provided with a website, a code, and installation instructions for a specific application on their devices.

However, visiting the website and using the provided code triggered the download of rogue Windows or Mac clients loaded with info-stealing malware. Windows users received a combination of a remote access trojan (RAT) and an infostealer, while Mac users were infected with the notorious Atomic Stealer (AMOS) strain.

Campaign Ended, but Victims Remain at Risk

Following the exposure of the malicious campaign, cybercriminals reportedly ended it. The popular Web3 job listing site CryptoJobsList also removed fraudulent postings from its platform, warning previous applicants that they had fallen victim to the scam and advising them to scan their devices for malware.

Unfortunately, cryptocurrency scams continue to plague the digital world, with attackers constantly developing new, cunning techniques to target unsuspecting victims.

– While understanding how crypto scams work and their potential impact on you is crucial for defense, using specialized antivirus software can further enhance your protection – says Arkadiusz Kraszewski of Marken Systemy Antywirusowe, the Polish distributor of Bitdefender software. – With it, you can not only shield yourself from malware but also protect against the consequences of phishing campaigns.