Cybercriminals are targeting Web3 developers by posing as venture investors on LinkedIn, using fake video calls to deliver malware.
A significant cyberattack targeting Web3 developers and cryptocurrency experts has been uncovered by analysts at Moonlock Lab. The attackers masquerade as venture capitalists, leveraging LinkedIn to identify potential victims.
The hackers feign interest in the specialists' projects, initiating contact with offers of collaboration. They then share links to fraudulent video calls designed to infiltrate victims' systems with malware.
Fabricated Investment Funds
These cybercriminals have established three fictitious cryptocurrency funds: SolidBit Capital, MegaBit, and Lumax Capital. Their websites are crafted to appear legitimate, complete with corporate histories, investment portfolios, and fabricated executive profiles featuring images generated by artificial intelligence.
Using fake identities, the scammers reach out to specialists, praising their professional achievements to build trust before moving the conversation to messaging platforms and proposing video calls.
Malware Delivery Method
During these interactions, victims receive a link to a Calendly page that redirects them to a clone of a popular video conferencing service like Zoom or Google Meet. Upon accessing the site, a Cloudflare verification prompt appears, requiring users to confirm they are not robots, a tactic known as ClickFix.
By clicking the verification box, victims unknowingly copy malicious code to their clipboard. The site then instructs users to open their terminal, paste the copied code, and execute it, which can lead to severe security breaches depending on the victim's operating system.
- Windows: The malware operates in memory, avoiding detection by traditional security measures.
- macOS: The script checks for Python, downloads necessary libraries, and integrates itself into the system.
In some instances, attackers have sent applications that replicate the Zoom interface on Mac, capturing login credentials and transmitting them to the scammers via Telegram.
Possible Links to North Korean Hackers
The fake websites are registered under the name Anatoly Bigdash from Boston, a person whose existence is questioned by experts. The tactics employed by these attackers bear resemblance to those used by the UNC1069 group, which has been linked to North Korean cyber activities since 2018.
To mitigate risks, experts advise verifying the registration dates of domains associated with contacts and caution against services that request terminal commands for identity verification. Many phishing attempts can be detected early in the process when clicking on links.
In a related incident from June 2025, Mehdi Farouk, an investment partner at Hypersphere, was targeted in a phishing attack via a counterfeit Zoom call.
