Fake recruiters on LinkedIn spread malware via GitHub

Security researchers at SlowMist have raised the alarm about a targeted attack campaign in which criminals pose as Web3 recruiters on LinkedIn. They build trust through conversations about work experience and job interviews, then share a malicious GitHub project that fully compromises the developer’s machine.

How the attack works

The approach follows a carefully crafted script. The attackers contact victims via LinkedIn, introduce themselves as a recruiter or project representative, and gain the targets’ trust by chatting extensively about work experience and an upcoming job interview. At some point, they send a link to a GitHub repository that is supposed to serve as a so-called MVP, an initial version of the product the candidate should review before the conversation.

Once the developer clones the project and runs the standard build commands, a hidden Node.js loader disguised as a Tailwind plugin in the file theme/js/auron-core.min.js activates. This loader launches three separate payloads in the background. The first collects browser data, passwords, and crypto wallet information. The second scans the system for sensitive files such as private keys, API keys, and .env files, and sends them to external servers. The third payload opens a permanent WebSocket connection that allows attackers to execute commands remotely, view files, and monitor the victim’s clipboard.

Fake profile as a means to build trust

According to images from the investigation, the attackers use credible LinkedIn profiles. One visible profile shows someone posing as an Executive Business Manager at BitAngels Investment Group, with a complete profile including a profile picture, connections, and recent posts about seeking Web3 developers. Such fake profiles make it difficult for victims to recognise the scam in time.

SlowMist classifies the threat as critical and publishes the corresponding indicators of compromise, including the malicious IP address 172.86.126.76 and several related URLs used by the malware to upload stolen data and establish communication. Developers who have recently run a similar GitHub project are advised to immediately check their systems for traces of the malware and to replace their passwords and API keys.

SlowMist advises all developers to always check the scripts, dependencies, and build configurations of unknown repositories before running them. The full technical report is available via the SlowMist Medium account.