Fake recruiter attacks on crypto teams
In fake recruiter attacks, threat actors posing as hiring managers from real crypto companies approach developers and operations staff, then ask them to complete a 'technical assessment' that requires running code locally. The code installs malware that gives the attackers persistent access. Lazarus Group runs this as its 'Contagious Interview' campaign.
How the attack works
- Attackers create convincing LinkedIn profiles posing as recruiters from legitimate crypto companies.
- They contact developers, security engineers and operations staff at target organisations.
- Candidates are invited to complete a “technical assessment” that involves running code locally, often a repository to clone or an npm package to install.
- The assessment contains malware that establishes persistent access to the victim’s machine.
The malware is custom built and updated often, so standard antivirus frequently misses it. Once it is running, the attackers have what is on that machine: credentials, private keys, internal messages, and a starting point to move deeper into the organisation.
Why it works
It targets people when they are motivated to cooperate, and it moves the attack onto the very machines that have access to code, infrastructure and sometimes keys. It has targeted hundreds of cryptocurrency professionals globally, and investigators linked it to the cluster behind the $1.5 billion Bybit theft.
How to defend against it
- A clear rule: no code from outside contacts runs on work devices.
- Separate, disposable environments for anything that must be run.
- Hardware security keys so stolen passwords alone are not enough.
- Endpoint detection that watches for the behaviour of remote access tools.
- Training that uses this exact scenario, and social engineering tests that check it worked.
- An assumed breach test to see what an attacker could reach from a developer laptop.
Frequently asked questions
How do I recognise a fake recruiter?
Be wary of unsolicited approaches that move quickly to a coding task, ask you to clone a repository or install a package, or push you to run something on the machine you use for work. Real employers rarely need you to run their code on your own device.
What should a company do about it?
Make it a written policy that staff never run code from outside contacts on work machines, give developers an isolated environment for anything they must test, and include the scenario in security training and phishing simulations.
Published Updated