Fake Web3 Interviews Deploy NeedleStealer and hVNC RAT via Signed ClickOnce
A sophisticated phishing campaign uses fake Web3 job interviews to trick victims into installing malware that steals cryptocurrency keys and sensitive data.
Cybercriminals are leveraging the allure of cryptocurrency careers to deploy sophisticated malware through convincing phishing campaigns. A recent operation targets Web3 professionals by posing as recruiters on LinkedIn, conducting interviews via Calendly, and presenting a technical assessment disguised as a Google Sheet. This carefully crafted social engineering tactic aims to bypass user caution by mimicking legitimate professional interactions.
The attackers' payload is delivered via a signed Microsoft ClickOnce application, a deployment technology often perceived as trustworthy by Windows users. This application, masquerading as a Google API helper, contacts attacker-controlled infrastructure to download a password-protected archive. Inside this archive, executables are hidden within files named as PNG images, a common tactic to evade basic detection mechanisms.
Once executed, the malware installs two distinct threats: NeedleStealer, a Rust-based information stealer, and a Go remote access trojan (RAT) equipped with hidden virtual desktop capabilities. The use of a signed installer allows attackers to update payloads without needing to re-sign each new iteration, increasing their operational flexibility and resilience against takedowns.
NeedleStealer is designed to exfiltrate a wide range of sensitive data, including browser credentials, active session cookies, cryptocurrency wallet private keys, Telegram chat data, and screenshots. The Rust variant further broadens the scope, targeting password managers, VPN and SSH credentials, developer tools, and cloud configuration secrets, leading to potentially catastrophic financial and data breaches for victims.
The Go RAT provides attackers with comprehensive remote control over compromised systems. Its capabilities include arbitrary command execution, file system browsing, keylogging, proxying, in-memory execution, and establishing persistence. Crucially, it features a hidden Virtual Network Computing (VNC) function, allowing attackers to operate a separate desktop session on the victim's machine without the user's knowledge, significantly increasing the risk of undetected lateral movement and data exfiltration.
This campaign highlights a growing trend of attackers exploiting the job-seeking process, particularly within high-value sectors like Web3 and cryptocurrency. The attackers' ability to compromise private keys and assets across multiple blockchain networks within an hour underscores the severe financial implications of such attacks. The stolen Ether was consolidated into a staging wallet, demonstrating a clear financial motive.
Security researchers emphasize that a compromised developer workstation should be treated as a complete exposure of all accessible credentials, sessions, wallet keys, cloud tokens, and deployment secrets. Simple removal of the malicious application is insufficient when persistent remote access may remain. Organizations are advised to independently verify recruiters, handle interview materials in isolated environments, and implement robust security monitoring for indicators such as unexpected WebView2 processes, encrypted archive extractions, and suspicious network traffic to known command-and-control servers.
The campaign's infrastructure, including domains like gapidriver[.]com for ClickOnce hosting and diegovalanire[.]digital for the NeedleStealer backend, along with specific IP addresses for the Go RAT C2 server, provides crucial indicators of compromise for detection and response efforts. While overlaps exist with a broader Google Workspace-themed ecosystem, the specific lure and delivery mechanism point to a coordinated campaign rather than a single, isolated actor.