Listen to this Post
Introduction: The New Face of Web3 Recruitment Scams
The rapid growth of Web3, cryptocurrency, and blockchain-related careers has created a new opportunity for cybercriminals: fake job opportunities designed not to hire victims, but to infect them. A newly discovered campaign is exploiting the trust placed in professional recruitment processes by creating fake application platforms that secretly deliver powerful information-stealing malware to both macOS and Windows users.
Security researchers discovered that attackers are distributing malicious installers through websites designed to appear like legitimate Web3 employment services. Behind the fake recruitment process is a sophisticated malware operation focused on stealing browser credentials, cryptocurrency wallet information, authentication sessions, and sensitive personal data.
Unlike traditional malware campaigns that rely on obvious phishing emails or suspicious downloads, this operation uses a more advanced psychological approach. Attackers understand that cryptocurrency professionals, developers, and investors frequently install new tools, participate in interviews, and test platforms. They abuse this normal workflow to make malware execution appear like a routine professional activity.
The campaign demonstrates a growing trend in cybercrime: attackers are no longer relying only on technical vulnerabilities. Instead, they are combining social engineering, realistic user interfaces, and customized malware designed specifically for each operating system.
Fake Job Application Platform Delivers Hidden Malware
Researchers investigating the campaign discovered malicious installers hosted through the domain relay[.]lc, which pretended to provide a Web3-related job application experience. Victims were encouraged to download software supposedly required for interviews, communication, or application processing.
The downloaded files appeared legitimate at first glance, but they contained hidden malware components designed for credential theft and cryptocurrency targeting.
The attackers created different infection methods depending on whether the victim used macOS or Windows. This platform-specific approach allowed them to exploit normal operating system behavior and increase the chances of successful infection.
Instead of using a single generic malware package, the threat actors developed separate attack chains that take advantage of the unique security mechanisms and user habits of each platform.
macOS Attack Chain Uses Terminal Commands and Fake System Prompts
The macOS version of the malware relies heavily on social engineering. Victims are instructed to open Terminal, drag a downloaded file into the Terminal window, and press Enter.
For many users, especially developers and cryptocurrency professionals, using Terminal is not unusual. Attackers abuse this familiarity to make the process appear technical and trustworthy.
Behind the scenes, the command executes a malicious shell script that performs several actions:
Copies a hidden executable from a concealed .back directory.
Places the malware inside the /tmp directory.
Removes
Launches the malware silently using nohup.
The removal of quarantine attributes is especially important because macOS normally warns users when applications come from unknown sources. By removing these protections, attackers attempt to bypass security controls.
Researchers also noted that the malicious disk image does not contain a legitimate .app bundle. This is a major warning sign because genuine macOS applications normally follow Apple’s application packaging structure.
Windows Version Uses Fake Updating Interface to Build Trust
The Windows variant follows a different strategy. Instead of asking users to interact with Terminal commands, attackers created a convincing fake software updater.
The installer was built using Electron and packaged through NSIS, technologies commonly used by legitimate applications. This choice helps the malware appear professional and reduces suspicion.
When launched, victims see an “Updating” screen with a progress bar. However, the progress is fake and controlled by random increments designed only to create the illusion that a real installation process is occurring.
When the progress reaches approximately 80%, the application triggers an internal message called:
runUpdate
This activates a hidden PowerShell command that performs the real infection process.
The command:
Requests administrator privileges.
Uses -Verb RunAs to trigger elevation.
Attempts to bypass PowerShell execution restrictions.
Launches an unsigned updater.exe file silently.
The fake update window keeps the victim distracted while malicious activity happens in the background.
Cryptocurrency Wallets Become the Main Target
Once installed, both malware versions focus heavily on stealing digital assets and authentication information.
Cryptocurrency users represent especially valuable targets because one successful wallet compromise can result in irreversible financial losses.
The malware searches for wallet extensions, browser information, authentication tokens, and stored credentials that can provide attackers with direct access to online accounts.
Targeted cryptocurrency wallet extensions include:
MetaMask
Phantom
Trust Wallet
Other browser-based Web3 wallet tools
The campaign shows that cybercriminals are increasingly treating crypto wallets as digital bank accounts that require the same level of protection as traditional financial systems.
Browser Theft Expands the Damage Beyond Crypto
The malware does not only focus on cryptocurrency.
It extracts sensitive information from major browsers including:
Chrome
Brave
Microsoft Edge
Arc
Stolen information includes:
Saved passwords
Cookies
Autofill information
Credit card details
Browser session tokens
The malware also targets approximately 286 browser extensions, including password managers and cryptocurrency-related extensions.
This creates a much larger threat because stolen browser sessions can allow attackers to bypass normal login protections.
Even when accounts are protected with passwords or multi-factor authentication, stolen cookies and active sessions may allow criminals to access accounts without needing the original credentials.
Telegram Sessions and Private Notes Are Also Targeted
The campaign expands beyond browsers by searching for private communication data.
The malware steals Telegram session information from the tdata directory.
This allows attackers to potentially hijack Telegram accounts without requiring passwords or verification codes.
The malware also scans Apple Notes for sensitive information such as:
Cryptocurrency recovery phrases
API keys
Private credentials
Security notes
For many cryptocurrency users, storing recovery phrases or wallet information inside notes applications is common but extremely dangerous.
A single stolen recovery phrase can provide permanent access to digital assets.
macOS Password Theft Uses Fake Security Warnings
One of the more advanced techniques used by the malware involves stealing macOS passwords.
The malware displays a fake AppleScript dialog that imitates a legitimate system error message.
Victims are tricked into entering their password, believing the operating system requires authentication.
The malware then combines this password with information from:
~/Library/Keychains/login.keychain-db
This combination gives attackers the ability to decrypt stored credentials.
Essentially, the malware attempts to steal both the key and the encrypted storage containing valuable information.
Attackers Monitor Victims Through Telemetry Systems
Researchers discovered that the malware communicates with a Sentry telemetry endpoint.
Sentry is normally used by developers for application monitoring and error reporting.
In this campaign, attackers appear to use similar telemetry functionality to monitor malware execution.
This allows criminals to track:
Successful infections
Victim environments
Malware behavior
Operational statistics
The use of legitimate development infrastructure demonstrates how modern malware campaigns increasingly blend normal software practices with malicious operations.
Deep Analysis: Technical Breakdown and Investigation Commands
Malware Execution Flow
The complete attack chain follows this structure:
Fake Web3 Job Website
|
↓
Malicious Installer Download
|
↓
Platform Detection
|
┌───────────────┐
| |
macOS Windows
| |
↓ ↓
Terminal Fake Update UI
Script Electron App
| |
↓ ↓
Payload PowerShell
Execution Execution
|
↓
Credential Theft
|
↓
Wallet Theft
|
↓
Data Exfiltration
macOS Investigation Commands
Security teams can investigate suspicious macOS activity using:
ps aux | grep -i tmp
Check temporary directory activity:
ls -la /tmp
Search suspicious hidden directories:
find ~/ -name ".back" -o -name ".sh"
Review quarantine removal activity:
log show --predicate 'eventMessage contains "xattr"' --last 24h
Check suspicious Terminal execution:
history | grep -E "curl|wget|bash|sh"
Windows Investigation Commands
Review PowerShell execution history:
Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational
Search for suspicious processes:
Get-Process | Where-Object {$_.Path -like "temp"}
Identify unsigned executables:
Get-AuthenticodeSignature C:\Path\updater.exe
Check persistence mechanisms:
Get-CimInstance Win32_StartupCommand
Indicators of Compromise
Suspicious Domains
Primary malware delivery domain:
relay[.]lc
Additional infrastructure:
cdnresolver[.]com
Security teams should monitor DNS requests, browser activity, and endpoint logs connected to these domains.
What Undercode Say:
The Web3 industry has become one of the most attractive hunting grounds for cybercriminals because it combines valuable assets, technically skilled users, and a culture where downloading new tools is normal.
This campaign is dangerous because it does not depend on exploiting a software vulnerability.
The attackers are exploiting human expectations.
A developer receiving a job invitation may expect to install interview software.
A cryptocurrency professional may expect to test a wallet integration tool.
A startup employee may expect a company-provided application update.
The malware hides inside these normal scenarios.
The biggest lesson from this campaign is that trust has become the primary attack surface.
Cybercriminals are investing heavily in making fake platforms look professional.
The fake update window, realistic recruitment workflow, and platform-specific installers show a significant evolution from older malware distribution methods.
The attackers are also clearly prioritizing high-value information.
Stealing a password is valuable.
Stealing browser sessions, wallet extensions, Telegram access, API keys, and recovery phrases is much more powerful.
A single infected machine could become a gateway into personal accounts, company systems, cryptocurrency holdings, and cloud infrastructure.
The use of Electron demonstrates another major trend.
Attackers increasingly abuse legitimate development frameworks because they provide credibility.
Security teams can no longer assume that modern frameworks indicate safe software.
The macOS attack is particularly interesting because it relies on user participation.
The victim is not simply opening malware.
The victim is being guided through a technical process that appears legitimate.
This creates a dangerous psychological advantage.
Organizations working in Web3, finance, and software development should treat job-related software downloads as high-risk events.
Identity protection is becoming just as important as endpoint protection.
Passwords alone are no longer enough.
Session tokens, browser cookies, wallet credentials, and authentication databases must also be protected.
Companies should implement application allowlisting, endpoint detection, phishing-resistant authentication, and employee awareness training focused on fake recruitment campaigns.
For cryptocurrency users, hardware wallets and offline recovery phrase storage remain among the strongest defenses.
The future of cybercrime will likely involve more personalized attacks that imitate professional workflows.
The question is no longer only “Can malware bypass security?”
The bigger question is “Can attackers convince users to help install it?”
This campaign proves that social engineering remains one of the most powerful weapons in modern cybersecurity.
✅ Confirmed: The campaign targets both macOS and Windows systems.
Researchers identified separate infection methods designed specifically for each operating system, showing a coordinated cross-platform malware operation.
✅ Confirmed: Cryptocurrency wallets and browser data are major targets.
The malware focuses on wallet extensions, browser credentials, cookies, and authentication-related information.
✅ Confirmed: The malware uses social engineering instead of relying only on vulnerabilities.
The fake job application process and fake updater interface demonstrate a human-focused attack strategy.
❌ Not confirmed: Every Web3 job application platform is dangerous.
The campaign targets fake platforms created by attackers. Legitimate recruitment systems remain widely used and secure when properly verified.
Prediction
(+1) Cybersecurity awareness around Web3 recruitment scams will increase as organizations realize that social engineering attacks are becoming more sophisticated. Companies will likely introduce stricter verification procedures for interview software, employee onboarding tools, and external applications.
(-1) Attackers will continue creating more realistic fake professional platforms targeting developers, crypto users, and remote workers. Future campaigns may combine artificial intelligence-generated websites, fake recruiters, and automated malware customization to increase success rates.
(-1) Cryptocurrency users will remain attractive targets because wallet theft provides immediate financial rewards. Without stronger security habits, recovery phrase theft and session hijacking campaigns are expected to continue growing.
(+1) Security tools will increasingly focus on detecting suspicious user behavior, not only malicious files. Monitoring unusual credential access, wallet extension activity, and unauthorized session extraction will become a critical defense strategy.
▶️ Related Video (78% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.digitaltrends.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
