LinkedIn Recruiters Luring Software Engineers into Malware Trap

Cybercriminals are targeting software engineers through sophisticated phishing campaigns on LinkedIn, posing as recruiters to deliver high-impact malware. By leveraging the current volatility of the IT job market, attackers lure experienced developers with fake job offers that lead to a compromised development environment.

According to a technical analysis by codedge.de, the attack begins with phishing outreach on LinkedIn, where attackers impersonate legitimate companies, such as Bitway, without their knowledge. Once a victim is engaged, they are sent a coding challenge hosted in a Bitbucket repository. The repository contains a TypeScript codebase that appears legitimate but includes a remote-code execution loader. When the developer runs standard startup commands, the loader fetches obfuscated JavaScript from an external endpoint, api.jsonbin.io, to initiate the infection.

The Malware Architecture

The deployed payload functions as both a Remote Access Trojan (RAT) and a credential stealer. The malware is structured into four primary modules designed for comprehensive data exfiltration. The 'scdata' module provides an interactive RAT capable of shell access and screen capture, while the 'ldata' module focuses on stealing browser data and cryptocurrency wallets. Specifically, the 'ldata' module targets 28 different wallet extensions, including Coinbase, Phantom, and MetaMask.

Beyond browser data, the malware includes a dedicated file grabber that searches for sensitive system secrets, including AWS credentials, SSH keys, and environment (.env) keys. A fourth module monitors the user's clipboard in real-time. To evade detection by security researchers, the RAT employs VM fingerprinting, checking system_profiler and /proc/cpuinfo to determine if it is running within a sandbox or virtual machine.

Why This Attack is Effective

This campaign is particularly dangerous because it exploits the professional curiosity and trust of developers. By providing a realistic-looking project with a large volume of files, the attackers hide the malicious loader within a sea of legitimate code. Because the malware executes under the user's own account, it does not require administrative privileges to access highly sensitive, user-owned data like SSH keys and browser-stored passwords.

What to Watch

Security professionals should warn developers to be wary of unsolicited job offers that require cloning external repositories and running installation scripts. The use of legitimate services like LinkedIn and Bitbucket helps the attackers bypass traditional email filters. While the current campaign has been linked to the impersonation of firms like Bitway, the modular nature of the malware suggests it can be easily adapted to target other industries or use different lures as the job market shifts.