Scammers posing as crypto recruiters have siphoned off about US$11.8 million (S$15.1 million) in Singapore by luring job candidates into installing malware that let attackers hijack corporate systems, the Singapore Police Force and the Cyber Security Agency of Singapore warned in a joint advisory. How the scheme unfolds - Targets are approached on LinkedIn by fake recruiters and moved to email conversations that use spoofed domains that closely mimic legitimate firms. - Candidate interviews are conducted over Google Meet; the “interviewer” keeps their camera off. - Victims are directed to a counterfeit website to complete a coding assessment and are asked to run the assessment on a company-issued device. - The assessment contains malware that captures a session token—a string used to authenticate a logged-in session. Because the token represents an already-authenticated session, attackers can bypass multi-factor authentication. - Using the stolen token, the attackers accessed the victim’s Bitbucket account (where the company stores source code), modified software systems, penetrated internal servers, harvested credentials, and exploited approval and transaction controls to move funds. The advisory does not name the affected company, disclose where the stolen funds were sent, or attribute the attacks to any specific actor. Decrypt has contacted LinkedIn for comment. A growing, well-documented playbook Security researchers have documented similar operations for years. The so-called “Contagious Interview” campaign steers Web3 developers toward malicious code and has seen more than 300 tainted packages appear on npm. Another group, TraderTraitor, has used fake job offers to reach corporate cloud systems—presumably because that’s where larger sums are held—rather than just individual wallets. Other campaigns impersonated recruiters from Coinbase and Uniswap to trick targets into running commands; some of those operations have been attributed to North Korean threat actors. Separately, a Russian-speaking group called Crazy Evil built a mock Web3 firm (ChainSeeker.io) and advertised analyst roles to trick applicants into installing wallet-draining malware. While certain campaigns are linked to specific actor clusters, the basic recruiter-to-malware playbook is widespread. Practical advice from Singapore authorities Individual safeguards: - Verify recruiters through official company channels before engaging. - Treat an interviewer who refuses to turn on their camera as a red flag. - Never run code or installers from unverified sources—especially on devices that access corporate resources. Corporate controls: - Secure API keys and internal credentials; reduce single points of failure. - Strengthen multi-factor authentication and consider more robust authentication methods that don’t rely solely on session tokens. - Monitor for unfamiliar devices and unusual network activity. - Limit where source repositories can be accessed from and restrict who can alter build/deploy pipelines. If you suspect a compromise: - Isolate affected systems immediately. - Revoke active sessions and reset credentials. - Review access logs and audit recent code and configuration changes. Why this matters for crypto companies and developers The incident highlights how social engineering can pivot from targeting individuals to compromising corporate infrastructure and high-value flows. Job-hunting developers who run assessments on company hardware can inadvertently hand attackers a path to source code, internal systems, and ultimately, funds. Tight operational hygiene—both personal and organizational—is essential to block this attack vector. If you were targeted or believe your organization may be affected, follow the containment steps above and contact local authorities or your incident response provider. Read more AI-generated news on: undefined/news