In a sophisticated and alarming case of cyber sabotage, an engineer was lured into a series of fraudulent job interviews that led to a significant security breach. The incident, which took place in September, began when the engineer received messages through a legitimate job-search platform from an individual impersonating a project director. This fraudulent character arranged a two-round interview process, which included interactions with a fake HR representative and a supposed CEO of a non-existent company.

During the initial video interview, the fake HR representative shared a social media account featuring authentic-looking personal images and videos. The subsequent interview took place over a chat application, during which the engineer was instructed to download an “assignment.” This job-related document was, in fact, a link to a code repository that contained malicious software, which successfully executed on the engineer’s device during its installation.

According to reports from Binance, the malware utilized advanced techniques for obfuscation and evasion. Notably, it replaced a legitimate component of a development tool with a malicious version, enabling it to execute commands and communicate with an external server controlled by the attackers. At the time of the intrusion, endpoint security measures failed to detect the zero-day malware. Furthermore, the attackers took additional precautions to mask their activities, making it even harder to identify and investigate the breach afterward.

As the saga unfolded, the attackers capitalized on the compromised engineer’s device on October 20. Utilizing an internal AI tool, they gained access to two additional engineer devices, including the one initially targeted via the Trojanized Homebrew installer. Notably, the first engineer’s wallet contained tokens that provided access to a container deployment.

On October 29, during a window between 17:15 and 19:56 UTC, the criminals logged into the third engineer’s device, utilizing the stolen credentials to deploy a container and activate a script that initiated unauthorized transfers. This breach also allowed them to extend their access to an internal wallet-signing service, facilitating transactions that circumvented the usual withdrawal protocols.