Fake Web3 Interview Campaign Delivers NeedleStealer and hVNC RAT via Signed ClickOnce
Key Takeaways A sophisticated phishing campaign is targeting Web3 professionals through fake job interviews to deploy malware. Attackers leverage LinkedIn and seemingly legitimate platforms like...
Key Takeaways
- A sophisticated phishing campaign is targeting Web3 professionals through fake job interviews to deploy malware.
- Attackers leverage LinkedIn and seemingly legitimate platforms like Calendly and Google Sheets to deliver signed Microsoft ClickOnce applications.
- The malware, identified as NeedleStealer and a Go-based hVNC RAT, can steal cryptocurrency private keys, browser data, cloud tokens, and grant hidden remote access.
- Victims have lost significant cryptocurrency assets, with one incident resulting in the theft of approximately 22.6 Ether across six chains within an hour.
- Organizations should implement strict verification protocols for recruiters and isolate interview-related software in secure, disposable environments.
Fake Web3 Interview Campaign Delivers Advanced Malware via Signed ClickOnce
Cybersecurity researchers have uncovered a sophisticated campaign employing fake job interviews to infiltrate cryptocurrency organizations, deploying advanced malware capable of stealing private keys, browser data, and other critical information. This operation highlights a growing trend of attackers leveraging targeted social engineering tactics against Web3 professionals.
Table Of Content
The elaborate scheme begins with a seemingly legitimate recruitment approach via LinkedIn, progressing to Calendly-scheduled interviews. Victims are then directed to a technical assessment presented as a Google Sheet. However, this assessment serves as a conduit to install malicious software delivered through a signed Microsoft ClickOnce application, a deployment format often perceived as trustworthy by Windows users.
Have I Been Squatted analysts said in a report, which was shared with Cyber Security News (CSN), that they identified this campaign after a cryptocurrency firm suffered a compromise in July 2026. The attackers exploited the victim’s public job search activity, demonstrating a tailored approach that capitalizes on real career aspirations rather than relying on broad, untargeted spam tactics. This precision allows for highly effective lures that resonate with potential targets.
Following the compromise, the attackers swiftly moved to extract assets, compromising private keys and siphoning funds across six different blockchain networks within approximately one hour. The stolen assets, totaling around 22.6 Ether, were subsequently consolidated into a staging wallet. Beyond cryptocurrency, the malware exfiltrated a trove of sensitive data, including passwords, active browser sessions, cloud tokens, source-control access credentials, and deployment secrets, according to the Have I Been Squatted analysts’ report.
Exploiting Trust: Signed ClickOnce for Payload Delivery
The fake technical assessment utilized a Google Apps Script page meticulously designed to mimic a standard Google-hosted workspace. This page initially gathered details about the visitor’s device and installed browser wallet extensions. It then displayed a fabricated “connector error,” prompting the target to install a supposed “Google API helper.”
This “helper” was, in fact, the malicious signed GapiUpdate.application package, delivered via ClickOnce. Once installed, it launched a legitimate Google Workspace page within WebView2, seamlessly blending the malicious activity with ordinary work processes. The application then established communication with attacker-controlled infrastructure, downloading a password-protected archive. This archive contained three files disguised as PNG images but were, in reality, Windows executables.
These executables ultimately deployed two primary payloads: NeedleStealer, a Rust-based information stealer, and a Go-based remote access trojan (RAT) featuring hidden virtual-desktop capabilities. This multi-layered payload delivery mechanism is strategic, allowing the attackers to use a trusted-looking installer to fetch diverse or updated payloads without requiring a new signed application for each modification, as detailed in the report.
NeedleStealer specifically targeted browser credentials, active sessions, cryptocurrency wallets, Telegram data, and screenshots. The Rust-based stealer expanded the compromise to include password managers, VPN and SSH configuration files, developer tools, and cloud service configurations. This comprehensive data exfiltration capability underscores the severe impact of such an attack.
This incident aligns with a broader pattern of cyberattacks where recruitment processes are weaponized to deliver malware. Previous reports on fake recruiter Web3 attacks have documented similar lures targeting blockchain professionals. Furthermore, analyses of ClickOnce infection chains illustrate how this legitimate Windows feature can be abused for highly targeted malware delivery.
Hidden Access Elevates Containment Challenges
The Go-based RAT provided attackers with not only stolen data but also extensive remote control over the compromised system. Its recovered capabilities include command execution, file browsing, keylogging, proxying, in-memory execution, persistence mechanisms, and both visible and hidden VNC functionality. The hidden VNC feature is particularly insidious, allowing attackers to operate a separate desktop session on the victim’s machine without any visible activity on the user’s screen.
This level of hidden access significantly alters incident response priorities. A compromised developer workstation must be immediately treated as a complete exposure of every credential, session, wallet key, cloud token, source-control token, and deployment secret accessible from that device. Simply removing a suspicious application is insufficient when attackers may retain persistent, covert remote access, as highlighted in the Have I Been Squatted report.
The researchers caution against attributing the intrusion to a single actor solely based on the lure, noting overlaps with a broader Google Workspace-themed attack ecosystem. While the evidence suggests a campaign relationship, it does not definitively prove a common operator. This distinction is crucial, as cybercriminals increasingly reuse services, lures, and signed delivery methods across different operations, complicating attribution efforts.
What You Should Do
- Verify Recruiters Independently: Always cross-reference recruiter contacts and job opportunities through official company websites and established channels. Do not rely solely on LinkedIn profiles or direct emails.
- Isolate Interview Software: If an interview process requires installing specific software or interacting with code, do so within a dedicated, disposable virtual machine or a sandboxed environment. Never use your primary work or personal device for such activities.
- Hunt for ClickOnce Anomalies: Security teams should actively monitor for unusual ClickOnce activity originating from unexpected sources, unexpected WebView2 processes, encrypted archive extractions, and executable files masquerading as common image types like PNGs.
- Monitor Network Traffic: Look for long-lived or suspicious traffic to known RAT command-and-control servers (e.g., 91.219.238.169:5556, 31.76.7.137:443, 45.125.67.42:443, vi-yaminnay[.]sbs:443).
- Incident Response Protocol: In case of a suspected compromise, immediately isolate the affected host. Rotate all passwords and access tokens, invalidate active browser sessions, and transfer any cryptocurrency funds to new wallets with newly generated keys from a clean, secure system.
- Review Indicators of Compromise (IoCs): Utilize the provided IoCs (URLs, domains, IP addresses, SHA-256 hashes, file names, scheduled tasks, mutexes, and certificate details) within your threat intelligence platforms and security information and event management (SIEM) systems for detection and blocking. Note: IP addresses and domains are intentionally defanged (e.g.,
[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
| Type | Indicator | Description |
|---|---|---|
| URL | https://n-cfjznllwrpfpmyyinhdgwemzxljuukztq3qp73q-0lu-script.googleusercontent.com/userCodeAppPanel |
Google Apps Script lure used for visitor triage and delivery |
| URL | https://gapidriver[.]com/installer/GapiUpdate.application |
Signed ClickOnce deployment manifest |
| URL | https://gapidriver[.]com/api/get.php |
Authenticated stage-two configuration endpoint |
| URL | https://gapidriver[.]com/api/rest.php |
Status-reporting endpoint used after payload dispatch |
| URL | https://www.dropbox.com/scl/fi/vwtoo632m1y8sqnm5vplm/Razo.rar?...&dl=1 |
Hosted password-protected archive delivered by the stager |
| Domain | gapidriver[.]com |
ClickOnce hosting and control infrastructure |
| Domain | diegovalanire[.]digital |
NeedleStealer backend |
| IP address and port | 91.219.238.169:5556 |
Go RAT and hVNC command-and-control server |
| IP address and port | 31.76.7.137:443 |
Primary Rust stealer TLS relay |
| IP address and port | 45.125.67.42:443 |
Secondary Rust stealer TLS relay |
| Domain and port | vi-yaminnay[.]sbs:443 |
Third Rust stealer TLS relay |
| Network path | analytics.gif |
Rust stealer relay path |
| Network path | pixel.png |
Rust stealer relay path |
| Network path | content.js |
Rust stealer relay path |
| SHA-256 | 7866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5 |
GapiUpdate.application version 1.0.0.201 manifest |
| SHA-256 | fafa019e18d44a47c615da188d7d56a15364ded87a13e3c405b195b4f48314cd |
ddsfwef.png, Rust wrapper for NeedleStealer |
| SHA-256 | 839f6d29d0a0a79bb5ce0a8a0326f3dc8f291ffb87e2c55f68c23a5ed69dbf72 |
eeewr.png, Rust stealer wrapper |
| SHA-256 | a7dc0a626d84e17f16d5fc1096e4478298b2a4b61b42a1cf25043cccf846a50a |
fdsfgweg.png, Go RAT and hVNC loader |
| SHA-256 | 487f15344db40bca9c8cd853d76cd3e56f15422c9db73e4bc2c2b6c0bcea2806 |
Recovered NeedleStealer payload |
| SHA-256 | 112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc |
Recovered Rust svc stealer payload |
| SHA-256 | 99c4dcc677942513ff39846aba051d1baeaaa5ad083dabc9e3f9b49a522b0a0a |
Recovered Go RAT and hVNC payload |
| File name | GapiUpdate.application |
Malicious signed ClickOnce manifest |
| File name | Razo.rar |
Password-protected archive containing payload wrappers |
| File names | ddsfwef.png, eeewr.png, fdsfgweg.png |
PE executables disguised as PNG files |
| File names | Launcher.exe, GapiUpdate.exe, GapiUpdate.dll |
ClickOnce-installed and stager components |
| Scheduled task | DeviceSetupManager |
RAT persistence task |
| Mutex | Global{557C15A4-4040-47C3-B1B6-A6A5B0518BA7} |
Go RAT host mutex |
| Public-key token | 4ae39df2f018c2be |
Public-key token for analyzed ClickOnce version |
| Public-key token | 38ce3b33a131d
|
No Comment! Be the first one.