Singapore authorities report $11.8 million lost to scams involving fake job offers from cryptocurrency companies.
Scam Overview
- Singapore's authorities report $11.8 million lost to scams involving fake job offers in the cryptocurrency sector.
- A victim was tricked into completing a coding assessment on a corporate device, leading to a security breach.
- Malicious software allowed attackers to bypass security measures and access sensitive company accounts.
The Singapore Police Force and the Cyber Security Agency have issued a warning regarding a surge in scams posing as job offers from cryptocurrency companies, resulting in losses amounting to $11.8 million (S$15.1 million). These scams involve fraudsters impersonating recruiters to deceive job seekers.
In a recent case, a victim was contacted via LinkedIn by someone posing as a recruiter for a crypto firm. The communication shifted to email, where the scammer used a domain name resembling that of a legitimate company. The victim underwent multiple interviews on Google Meet, where the interviewer's camera remained off.
Subsequently, the victim was directed to a fraudulent website to complete a coding assessment, inadvertently downloading malware onto a company-issued laptop. This malware captured a session token, which allowed the attackers to sidestep multi-factor authentication and access the victim's Bitbucket account.
Once inside the account, the attackers altered software systems and accessed internal servers, acquiring credentials that allowed them to bypass transaction limits and approval processes to steal funds. Specific company names and details regarding the stolen funds have not been disclosed, and authorities have not identified the perpetrators. Media outlets have reached out to LinkedIn for comments regarding the incident.
Escalating Threats
The scam is part of a broader pattern known as Contagious Interview, where fake recruiters lead Web3 developers to malicious code, including over 300 harmful packages found in the npm registry. A group named TraderTraitor has been using similar tactics to infiltrate corporate cloud systems, rather than targeting individual wallets, which are often more secure.
While many of these scams are attributed to North Korean hackers, other groups, such as the Russian-speaking Crazy Evil, have also employed similar strategies. They created a fake Web3 company, ChainSeeker.io, to lure job seekers into downloading malware that could compromise their wallets.
To safeguard against such scams, Singaporean authorities recommend verifying recruiters through official channels, remaining vigilant if interviewers do not activate their cameras, and refraining from executing code from unverified sources. Companies are advised to secure API keys, enhance multi-factor authentication, and monitor for unusual network activities. In case of a suspected breach, they should isolate affected systems, revoke active sessions, reset credentials, and review access logs.
