【PR】新作 9/7発売 — 最安 ¥5,420

Fake job interviews are again being used to breach cryptocurrency teams. In a documented case, a convincing Web3 recruitment process led a Windows user to install malware that stole private keys, browser data, and other sensitive information. The operation began with a recruiter contact on LinkedIn, followed by Calendly interviews and a technical assessment presented as a Google Sheet. Instead of a harmless document, the assessment sent the target toward a signed Microsoft ClickOnce application, a Windows deployment format seen as trustworthy. Analysts at Have I Been Squatted identified the campaign after a cryptocurrency organization was compromised in July 2026. The victim’s visible job search created the opening, showing how attackers can tailor a lure around real career changes rather than rely on broad, untargeted spam. Fake Web3 Interview Uses Signed ClickOnce to Deploy NeedleStealer and hVNC RAT Have I Been Squatted analysts said in a report shared with Cyber Security News (CSN) that the private keys were compromised and assets were removed across six chains within about an hour. The attackers later consolidated roughly 22.6 Ether in a staging wallet, while the malware exposed passwords, active browser sessions, cloud tokens, source-control access, and deployment secrets. Fake Web3 Interview Uses Signed ClickOnce The fake assessment used a Google Apps Script page that looked like a normal Google-hosted workspace. It collected details about the visitor’s device and browser wallet extensions, then displayed a connector error that pushed the target to install a supposed Google API helper. The signed GapiUpdate.application package opened a real Google Workspace page inside WebView2, helping the activity blend into an ordinary work process. It then contacted attacker infrastructure and downloaded a password-protected archive whose three files were named as PNG images but were Windows executables. ClickOnce installer for GapiUpdate from gapidriver[.]com, captured from version 1.0.0.182 (Source – Have I Been Squatted) Those files ultimately delivered NeedleStealer, a separate Rust-based information stealer, and a Go remote access trojan with hidden virtual-desktop capabilities. This layered approach matters because a trusted-looking installer can fetch replacement payloads later, reducing the need to sign a new application for every change. The NeedleStealer branch targeted browser credentials, sessions, wallets, Telegram data, and screenshots. The Rust stealer broadened the exposure to password managers, VPN and SSH material, developer tools, and cloud configuration. The campaign fits a wider pattern in which recruitment conversations become the delivery route for malware. Recent reporting on  fake recruiter Web3 attacks  shows similar lures aimed at blockchain professionals, while a  ClickOnce infection chain report  illustrates how the Windows feature can be abused for targeted delivery. Hidden Access Raises Containment Stakes The Go RAT gave operators stolen data and remote control. Its recovered capabilities included command execution, file browsing, keylogging, proxying, in-memory execution, persistence, and both visible and hidden VNC. Hidden VNC can let an attacker operate a separate desktop session without the user seeing the activity on screen. That access changes incident response priorities. A compromised developer workstation should be treated as an exposure of every credential, session, wallet key, cloud token, source-control token, and deployment secret reachable from that device. Removing a suspicious application alone is not enough when the attacker may retain remote access. Teams should verify recruiters independently through official company channels and handle interview software or code in a separate, disposable environment. ClickOnce SideBySide 2.0 registry writes from the 1.0.0.182 install (Source – Have I Been Squatted) The advice mirrors guidance from coverage of  malicious interview coding tests , where reviewing unknown files and isolating assessment material can prevent a personal device from becoming the first point of entry. Security teams should hunt for ClickOnce activity tied to the listed origin, unexpected WebView2 processes, encrypted archive extraction, executables masquerading as PNG files, and long-lived traffic to the RAT server. They should isolate suspected hosts, rotate passwords and access tokens, invalidate browser sessions, and move any wallet funds using clean systems and newly generated keys. The source cautions against attributing the intrusion to a single actor solely from the lure. It notes overlaps with a broader Google Workspace-themed ecosystem, but says the evidence supports a campaign relationship rather than a proven common operator. That distinction is important as criminals increasingly reuse services, lures, and signed delivery methods. Indicators of compromise (IoCs):- Type Indicator Description URL https://n-cfjznllwrpfpmyyinhdgwemzxljuukztq3qp73q-0lu-script.googleusercontent.com/userCodeAppPanel Google Apps Script lure used for visitor triage and delivery URL https://gapidriver[.]com/installer/GapiUpdate.application Signed ClickOnce deployment manifest URL https://gapidriver[.]com/api/get.php Authenticated stage-two configuration endpoint URL https://gapidriver[.]com/api/rest.php Status-reporting endpoint used after payload dispatch URL https://www.dropbox.com/scl/fi/vwtoo632m1y8sqnm5vplm/Razo.rar?...&dl=1 Hosted password-protected archive delivered by the stager Domain gapidriver[.]com ClickOnce hosting and control infrastructure Domain diegovalanire[.]digital NeedleStealer backend IP address and port 91.219.238.169:5556 Go RAT and hVNC command-and-control server IP address and port 31.76.7.137:443 Primary Rust stealer TLS relay IP address and port 45.125.67.42:443 Secondary Rust stealer TLS relay Domain and port vi-yaminnay[.]sbs:443 Third Rust stealer TLS relay Network path analytics.gif Rust stealer relay path Network path pixel.png Rust stealer relay path Network path content.js Rust stealer relay path SHA-256 7866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5 GapiUpdate.application  version  1.0.0.201  manifest SHA-256 fafa019e18d44a47c615da188d7d56a15364ded87a13e3c405b195b4f48314cd ddsfwef.png , Rust wrapper for NeedleStealer SHA-256 839f6d29d0a0a79bb5ce0a8a0326f3dc8f291ffb87e2c55f68c23a5ed69dbf72 eeewr.png , Rust stealer wrapper SHA-256 a7dc0a626d84e17f16d5fc1096e4478298b2a4b61b42a1cf25043cccf846a50a fdsfgweg.png , Go RAT and hVNC loader SHA-256 487f15344db40bca9c8cd853d76cd3e56f15422c9db73e4bc2c2b6c0bcea2806 Recovered NeedleStealer payload SHA-256 112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc Recovered Rust  svc  stealer payload SHA-256 99c4dcc677942513ff39846aba051d1baeaaa5ad083dabc9e3f9b49a522b0a0a Recovered Go RAT and hVNC payload File name GapiUpdate.application Malicious signed ClickOnce manifest File name Razo.rar Password-protected archive containing payload wrappers File names ddsfwef.png ,  eeewr.png ,  fdsfgweg.png PE executables disguised as PNG files File names Launcher.exe ,  GapiUpdate.exe ,  GapiUpdate.dll ClickOnce-installed and stager components Scheduled task DeviceSetupManager RAT persistence task Mutex Global\\{557C15A4-4040-47C3-B1B6-A6A5B0518BA7} Go RAT host mutex Public-key token 4ae39df2f018c2be Public-key token for analyzed ClickOnce version Public-key token 38ce3b33a131dca3 Public-key token associated with earlier ClickOnce build Certificate serial 4D6ABBFC7C052CBAFAA53659971AC471 Code-signing certificate serial Certificate SHA-1 12730A7DD9AF98F14441D476C10EB346708C1194 Code-signing certificate thumbprint Authorization token Bearer XyZ4pQ9mLwD2TfA7 Authorization value used for the stage-two configuration request Archive password NSckskj24vd Password supplied for extraction of  Razo.rar Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Stop new phishing & malware before they compromise your business.  Integrate live intel from 15K SOCs around the world The post Fake Web3 Interview Uses Signed ClickOnce to Deploy NeedleStealer and hVNC RAT appeared first on Cyber Security News .

Sin comentarios… Visto en ClickOn Detroit vía Neatorama.