Cybersecurity experts have uncovered a sophisticated scheme targeting cryptocurrency professionals through fake Web3 job interviews. This tactic involves deploying malware such as NeedleStealer and hVNC RAT, capitalizing on job seekers’ vulnerability.
Deceptive Recruitment Tactics
The attack begins with a LinkedIn recruiter approach, followed by scheduled interviews via Calendly and a technical test presented as a Google Sheet. However, instead of a benign document, the victim is led to a signed Microsoft ClickOnce application, often perceived as secure by Windows users. This approach successfully duped a cryptocurrency organization in July 2026, highlighting how real career transitions are exploited over generic spam tactics.
Malware Deployment Details
The malicious scheme was identified by Have I Been Squatted analysts, who reported that attackers quickly compromised private keys and assets across multiple cryptocurrency chains. The malware also exposed passwords, browser sessions, and cloud tokens. The fake assessment used a Google Apps Script to gather device and browser wallet data, then misled the victim into downloading a supposed Google API helper.
Technical Insights and Prevention
The attack’s technical aspects involve a signed GapiUpdate.application package that creates a seamless illusion of a standard workspace. Once engaged, it connects to attacker servers, downloading a password-protected archive disguised as PNG files, which are actually Windows executables. The NeedleStealer malware targets browser credentials, developer tools, and more, while the Go RAT provides remote control capabilities.
To mitigate such threats, experts advise verifying recruiters through official channels and using isolated environments for handling interview-related software. Monitoring for ClickOnce activity and unexpected processes is crucial, along with updating passwords and access tokens regularly.
The broader context suggests that recruitment conversations are increasingly becoming conduits for malware distribution, with this particular campaign fitting a pattern of targeted attacks on blockchain professionals. Despite overlaps with other campaigns, analysts caution against attributing these attacks to a single entity.
Overall, this incident underscores the need for heightened vigilance in cybersecurity practices, especially within the cryptocurrency sector, where sensitive information can be quickly compromised by such sophisticated phishing strategies.
