SlowMist Detects Fake Recruitment Activities, Malicious GitHub Code Deceiving Developers

SlowMist has detected malicious activities targeting developers, where attackers exploit fake Web3 recruitment information to carry out their attacks. The attackers impersonate recruiters on LinkedIn, building trust through discussions about work experience and interview processes, and then send a GitHub repository disguised as "interview MVP" to lure developers into running the project. Analysis reveals that the malicious repository hides theme/js/auron-core.min.js as a Tailwind plugin. When developers run the development or build commands for the project, the hidden Node.js loader is triggered, deploying multiple payloads, including stealing browser credentials and wallet data, collecting and exfiltrating sensitive files, executing remote commands and providing interactive shell access, and monitoring the clipboard. SlowMist advises developers to thoroughly check project scripts, dependencies, and build configurations before running unknown code repositories.