MalwarePublished 13 Aug 2025

Uncovering a Web3 Interview Scam

Source AlienVault OTX General

Description

A Ukrainian Web3 team's interview process involved cloning a GitHub repository containing malicious components. Analysis revealed the project replaced a legitimate dependency with a malicious NPM package, rtk-logger@1.11.5. This package collected sensitive data, including cryptocurrency wallet information, from popular browsers and uploaded it to an attacker-controlled server. The malware also implemented keylogging, screen capture, and clipboard monitoring. Two other GitHub accounts were found using a similar malicious package. The scam aimed to trick interviewees into executing malicious code, potentially leading to data leaks and asset theft. Developers are advised to exercise caution when handling unknown GitHub projects and to use isolated environments for execution.

Impact

For European organizations, especially those involved in blockchain, cryptocurrency, and Web3 development, this threat poses a significant risk to the confidentiality and integrity of sensitive data. The theft of cryptocurrency wallet information can lead to direct financial losses, which are often irreversible. Additionally, the malware's capabilities for keylogging, screen capture, and clipboard monitoring can expose a wide range of confidential information beyond wallets, including private keys, passwords, and proprietary code. This could lead to broader intellectual property theft and compromise of internal systems. The social engineering aspect targeting developers during interviews may also damage organizational reputation and trust, potentially affecting recruitment and operational security. Given the increasing adoption of Web3 technologies in Europe, the threat could impact startups, established tech firms, and financial institutions integrating blockchain solutions. The malware's ability to operate stealthily and exfiltrate data to attacker-controlled servers increases the risk of prolonged undetected breaches, complicating incident response and remediation efforts.

Defensive guidance

1. Implement strict policies for handling third-party code, especially in recruitment and interview processes. Avoid cloning or executing unverified repositories on production or personal machines. 2. Use isolated, sandboxed environments or virtual machines for testing unknown code to contain potential malicious activity. 3. Employ software composition analysis (SCA) tools to detect malicious or tampered dependencies in codebases, focusing on NPM packages and other package managers. 4. Monitor network traffic for unusual outbound connections, particularly to known malicious IPs or domains associated with this threat. 5. Educate developers and HR teams about social engineering tactics used in technical interviews, emphasizing caution with code execution. 6. Enforce multi-factor authentication and hardware wallets for cryptocurrency management to reduce the impact of credential theft. 7. Regularly audit and update dependency lists to remove or replace suspicious or deprecated packages. 8. Leverage endpoint detection and response (EDR) solutions capable of detecting keylogging, screen capture, and clipboard monitoring behaviors. 9. Collaborate with threat intelligence providers to stay updated on emerging malicious packages and indicators of compromise related to Web3 development environments.

Indicators of compromise

URLs 4

http://144.172.112.106:1224/client/5346/64
http://172.86.64.67/api/service/makelog
http://172.86.64.67/api/service/process/
https://api.npoint.io/96979650f5739bcbaebb

Hashes 1

af46c7917f04a9039eb0b439a7615ec07b7ad88048cb24fe23c454c16dffcd57

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 13 Aug 2025, 16:05 UTC

MITRE ATT&CK techniques15 from threat tags

Technical details

Indicators of compromise

URLs 4

Hashes 1

Community reviews

Related threats