Singapore: LinkedIn Crypto Scams Net $11.8 Million

Scammers Target Crypto Firms, Stealing $11.8 Million Through Fake Job Offers

Scammers posing as recruiters for cryptocurrency companies have successfully defrauded victims of $11.8 million (S$15.1 million) by leveraging fake job offers to compromise their employers’ systems, according to a joint advisory issued by the Singapore Police Force and the Cyber Security Agency of Singapore.

The agencies detailed the modus operandi of the scam in a statement released on Friday. The scheme typically begins with a victim being approached on LinkedIn by an individual claiming to be a recruiter for a cryptocurrency firm. Communications then shift to email, where the scammer uses a spoofed domain that closely mimics a legitimate company’s address. The process often involves several interviews conducted via Google Meet, during which the interviewer consistently keeps their camera off.

Following the interviews, the victim is directed to a fake website to complete a technical coding assessment. Crucially, this assessment is performed on a company-issued device, leading the victim to unknowingly download malicious software.

This malware is designed to capture a session token, a string that allows a service to keep a user logged in. By presenting this token, which signifies an already authenticated session, the attackers bypass multi-factor authentication and gain access to the victim’s Bitbucket account, a platform used for storing and managing source code.

Once inside, the attackers can alter the employer’s software systems and access internal servers. The agencies stated that the compromised credentials are then used to circumvent transaction limits and approval checks, ultimately enabling the theft of funds. The advisory does not name any specific companies involved, disclose the destination of the stolen funds, or attribute the attacks to any particular group.

This tactic is not new, with researchers having previously identified a long-running operation dubbed “Contagious Interview.” This operation involves fake recruiters directing Web3 developers toward malicious code, including over 300 booby-trapped packages uploaded to the npm registry. Another group, known as TraderTraitor, has employed similar fake job offers to infiltrate corporate cloud systems rather than targeting individual cryptocurrency wallets, a strategy one researcher suggested is due to the concentration of funds within these systems. Other attackers have impersonated recruiters from prominent companies like Coinbase and Uniswap to trick targets into executing commands.

While some of these campaigns have been attributed to North Korean hackers, the underlying playbook is not exclusive to them. The Russian-speaking group Crazy Evil, for instance, established a fabricated Web3 company, ChainSeeker.io, and advertised blockchain analyst roles to lure applicants into downloading malware designed to drain their digital wallets.

The Singapore agencies have provided advice for both individuals and companies. Individuals are urged to verify recruiters through official channels, treat interviewers who refuse to turn on their cameras as a red flag, and never execute code from unverified sources. For organizations, the recommendations include securing API keys and internal credentials, strengthening multi-factor authentication, and monitoring for unfamiliar devices and unusual network activity. In cases where a compromise is suspected, the agencies advise isolating affected systems, revoking active sessions, resetting credentials, and reviewing access logs.