New Crypto Scams Target Investors and Developers Through Fake Jobs

Hackers pose as recruiters and use malware to steal crypto wallets and credentials from developers and investors, security firms warn.

Cybercriminals are getting more creative in their attempts to steal cryptocurrency, and two new schemes have security experts sounding the alarm.

Security firm Kaspersky recently identified a malware framework (malicious software designed to secretly break into computers) that targets crypto investors. But it's not the only threat making headlines.

The fake job trap

According to blockchain security company SlowMist, hackers are now pretending to be Web3 recruiters (people hiring for jobs related to blockchain and crypto companies) on LinkedIn. Here's how the scam works:

Attackers contact blockchain developers, offering fake job opportunities.
They send victims a GitHub repository (an online folder where programmers store and share code), claiming it's a project to test before an interview.
When developers download and run this code, they unknowingly install malware.

The clever part? This process looks exactly like a normal technical interview, where developers regularly download and run code. That makes the trap very hard to spot.

What the malware steals

Once installed, the malicious software acts as a remote access trojan — a program that lets hackers secretly control a victim's device from far away. This gives attackers the ability to steal:

Project keys and cloud credentials (login details for online services)
Wallet extension data (information tied to browser-based crypto wallets that hold digital money)

A growing pattern

SlowMist warned that "this attack is not an isolated case." Criminals are increasingly using situations like job recruitment, code reviews, and project collaborations to trick developers into running harmful software themselves.

Just a day earlier, SlowMist flagged another campaign targeting macOS (Apple computer) users. That scheme aimed to steal login credentials, hijack Telegram messaging sessions, and eventually trick investors into typing their wallet recovery phrases (secret backup passwords that give full access to a crypto wallet) into fake websites.

The takeaway

These attacks show that hackers are targeting both everyday crypto investors and the developers who build the industry. Always double-check the source of any code, job offer, or website before trusting it — and never share your wallet recovery phrase with anyone.

This is an AI-generated summary. Read the original article at: https://cointelegraph.com/news/kaspersky-malware-framework-crypto-investors?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound