Fake job interview delivers wallet-draining malware to crypto job seekers
Security & Exploits ·
Attackers posing as recruiters for a Web3 company are asking candidates to build and run a fake real-estate-and-crypto-investment project that secretly installs credential-stealing software.
The scheme was flagged in an alert from SlowMist_Team, which identified the fraudulent repository as "RoyalCity" and traced it to a Bitbucket listing under the account poc_review58. According to the alert, the project hid malicious code inside a configuration file for Tailwind, a front-end styling tool, so that simply building or running the software could trigger a payload. That payload is capable of pulling credentials from browsers, extracting data from cryptocurrency wallet extensions, copying files from the victim's machine, tracking clipboard activity, and opening a channel for remote access to the infected device.
A second component, found in a file called errorHandler.js, functions as a server-side backdoor that fetches and runs code from a remote source, giving attackers an additional way to control compromised systems after the initial infection.
The alert notes that this operation closely mirrors an earlier campaign the same researchers had examined, one that used a poisoned GitHub project under a similar recruitment pretext. Both cases rely on the same lure — a fake interview task — the same Tailwind-based execution method, and payloads with near-identical data-theft and remote-access capabilities, suggesting the same actor or toolkit may be behind multiple campaigns.
Indicators tied to the RoyalCity case include a malicious IP address at 144.172.107.50, a domain hosted at server-azure-tau.vercel.app, and several upload and websocket endpoints linked to that IP. The two flagged files, tailwind.config.js and errorHandler.js, are each identified by distinct SHA-256 hashes, allowing security teams to check for matching samples in their own environments.
The alert recommends that candidates verify recruiters independently, inspect unfamiliar code before executing it, and keep any interview-related tasks separate from personal wallets, credentials, and everyday development setups. It also points to a free lookup tool for checking whether specific packages, domains, or IP addresses are considered safe.
What remains unclear is how many candidates were targeted or compromised before the campaign was detected, and whether the individuals behind RoyalCity are the same group responsible for the earlier GitHub-based attack. Coverage of the case remains limited, with two sources currently tracking the cluster, leaving open questions about the scale and origin of the operation.