New Fake Job Hacking Campaign Targets Web3 Professionals with Infostealing Malware

New Fake Job Hacking Campaign Targets Web3 Professionals with Infostealing Malware

A sophisticated new hacking campaign is preying on individuals in the Web3 and blockchain industries, with researchers warning about its growing reach and deceptive strategies.

The attack relies on enticing victims into downloading malware through a seemingly innocent job opportunity.

Clever Deception with Typosquatted Telegram Accounts

According to experts at Cado Security Labs, the campaign began in September 2024.

Victims are typically contacted on Telegram via a typosquatted account – a deceptive variation of a familiar contact's username.

This impersonation is highly targeted, with attackers taking time to study their victims before striking.

The initial outreach involves offering a promising job opportunity, along with an investment presentation connected to the target's company.

The level of preparation is evident.

Researchers say that the attackers meticulously set the stage, mirroring familiar communications and creating a false sense of trust.

This calculated approach makes victims more likely to believe the offer is legitimate and proceed with the interaction.

Malware Hidden Behind a Fake Meeting App

Once the victim is drawn in, they are invited to a video call using a business meeting application called Meeten.

However, this app is far from genuine.

Researchers report that Meeten has been rebranded multiple times, previously operating under names like Meetio, Meetone, Clusee, and Cuesee.

The attackers use these variations to enhance credibility and lure victims further.

To add another layer of believability, Meeten comes with a professional-looking website.

Victims are met with a fake error message during the call, claiming they need to reinstall the app or connect through a VPN.

This false message is intentionally designed to prompt victims into further actions while allowing the malware to operate undetected in the background.

Realst Malware Steals Cryptocurrency and Sensitive Information

The malware involved is identified as Realst, a type of infostealing program that surreptitiously harvests sensitive data from a victim’s device.

Once installed, Realst steals Telegram credentials, banking card details, browser cookies, and login credentials stored in the browser.

Additionally, it targets Keychain credentials and other stored access points, leaving victims vulnerable to financial theft.

Experts believe the primary goal of these attacks is cryptocurrency theft, given the high proportion of victims connected to the Web3 industry.

This would align with the campaign's strategy of targeting individuals who are likely to have access to digital assets.

A History of Success for Similar Fake Job Scams

The use of fake job offers as a hacking tactic is not new.

State-sponsored groups such as Lazarus, linked to North Korea, have exploited this approach for years.

Notably, one Lazarus attack led to one of the largest crypto heists in history, with hackers making off with an estimated $600 million in various cryptocurrencies.

The warning from Cado Security Labs highlights how these threats continue to evolve, employing social engineering and technological manipulation to exploit trust and opportunism.

Their findings suggest that this campaign could soon grow in scope, making it essential for Web3 professionals to exercise caution when engaging with new communications or job opportunities.

The full extent of Realst's reach remains unknown, but researchers are urging vigilance among anyone working in crypto and blockchain industries.

Ensuring strong security measures, confirming communications, and staying informed are vital steps to avoid falling victim to similar schemes.