Coinpaper 2025-04-25 11:34:14

Hackers Target Crypto Job Applicants Through GitHub And Freelancer Websites

In a fresh twist on a familiar scam, the Lazarus Group, a North Korea–linked hacking collective, has been preying on would-be crypto developers via freelancer platforms and GitHub job listings. The activity can be traced back to at least November 2023, when Palo Alto Networks Unit 42, a cybersecurity research company, first wrote about it, dubbing the activity CL-STA-240 Contagious Interview campaign. The latest report on the matter comes from Silent Push . According to the Virginia-based cyber-intelligence firm, Lazarus has set up three shell consulting companies – BlockNovas, Angeloper Agency, and SoftGlide – to lure candidates into downloading malware. Attackers pose as legitimate crypto consultancies, publishing job ads that promise high pay and remote flexibility. Applicants are invited to record a short introduction video. When candidates hit “record,” an innocuous “error” message pops up with a simple copy-and-paste fix, which quietly installs one of three malicious strains – BeaverTail, InvisibleFerret, or OtterCookie – on the victim’s device. Malpedia describes the first of the three as “a JavaScript malware primarily distributed through NPM packages (...) designed for information theft and to load further stages of malware, specifically a multi-stage Python-based backdoor known as InvisibleFerret.” The database doesn’t provide further clarification on the two other strains. The fake companies aim to boost their credibility by showcasing dozens of AI-generated “team member” profiles – some slightly tweaked from real photos – to populate fake LinkedIn and freelancer accounts. Two of the shell firms are legally registered in the US, and, as per SilentPush, they have been actively conducting the scam since 2024. The FBI has already seized the BlockNovas domain, although SoftGlide and Angeloper Agency remain live. Silent Push has identified two developers who fell prey to the scam. The first victim, nicknamed “topninja,” detailed in a post on Dev.to how they were led to compromise their MetaMask Wallet after accepting a new project on Freelancer.com. Topninja also shared the malicious code containing a request to lianxinxiao[.].com – a BeaverTail distributing domain. In March, at least three crypto founders foiled fake Zoom calls aimed at stealing private keys. Cybersecurity experts urge job seekers to verify company credentials, double-check URLs, and think twice before hitting “copy-paste” on unexpected prompts.

Наиболее читаемые новости

Donald Trump Didn't Miss the Big Rise: He Sta...
2025-04-29
Celsius Founder Faces 20 Years in Prison; Tok...
2025-04-29
Top 10 Altcoins to Look Up in May- BONK, XMR,...
2025-04-29
Exciting Future: Tether Co-Founder Predicts R...
2025-04-29
Bitcoin’s Battle to Confirm Key Support Level...
2025-04-29
Bitcoin in 'critical zone' as triple breakout...
2025-04-29
VIRTUAL price wakes up as post-breakout momen...
2025-04-29
TRUMP Token Starts to Crack, Bitcoin Consolid...
2025-04-29

https://www.digistore24.com/redir/325658/ceobig/

Связанные новости

Прочтите Отказ от ответственности : Весь контент, представленный на нашем сайте, гиперссылки, связанные приложения, форумы, блоги, учетные записи социальных сетей и другие платформы («Сайт») предназначен только для вашей общей информации, приобретенной у сторонних источников. Мы не предоставляем никаких гарантий в отношении нашего контента, включая, но не ограничиваясь, точность и обновление. Никакая часть содержания, которое мы предоставляем, представляет собой финансовый совет, юридическую консультацию или любую другую форму совета, предназначенную для вашей конкретной опоры для любых целей. Любое использование или доверие к нашему контенту осуществляется исключительно на свой страх и риск. Вы должны провести собственное исследование, просмотреть, проанализировать и проверить наш контент, прежде чем полагаться на них. Торговля - очень рискованная деятельность, которая может привести к серьезным потерям, поэтому проконсультируйтесь с вашим финансовым консультантом, прежде чем принимать какие-либо решения. Никакое содержание на нашем Сайте не предназначено для запроса или предложения