Opening
If you’re looking for a job in crypto, AI, or blockchain, you’ve probably seen dozens of listings promising exciting projects and high pay. But how can you tell a legitimate offer from a trap that could steal your devices and crypto assets? This article explains the common tactics used by malicious recruiters, how the malware works, and what steps you can take to protect yourself while pursuing online earning opportunities.
The plain explanation
A job‑scam recruiter pretends to represent a real company or a well‑known industry player. The scammer contacts you through social media, freelance platforms, or job boards and offers a seemingly attractive position. To move forward, they ask you to download a file—often described as a coding test, a software fix, or a video‑conference troubleshooting tool. That file is actually malicious software, or malware, which can give the attacker remote‑access trojans (RATs) or infostealing capabilities.
Once installed, the RAT creates a hidden backdoor into your computer. The attacker can then monitor keystrokes, capture screenshots, and copy files, including wallet seed phrases, private keys, and login credentials. Some malware also scans for cryptocurrency wallets on the device and automatically transfers funds to the attacker’s address. Because the initial contact appears to come from a reputable source, many victims overlook warning signs and execute the file.
Key terms:
- Malware: Software designed to damage, disrupt, or gain unauthorized access to a computer system.
- Remote‑access trojan (RAT): A type of malware that allows an attacker to control a victim’s computer over the internet.
- Infostealer: Malware that collects sensitive information such as passwords, cryptocurrency seed phrases, and personal documents.
- Seed phrase: A list of words that can recreate a cryptocurrency wallet; anyone with this phrase can move the wallet’s funds.
A real example
In September 2026, a joint advisory from Japan, Germany, Australia, and the United States identified the North Korean hacking group known as WaterPlum (also called Contagious Interview) as the operator of a large‑scale recruitment scam. The group targeted software developers and IT professionals by posting fake job ads for crypto, AI, and NFT companies. Victims were asked to download “coding assignments” or “fixes for video‑conferencing errors.” The files installed RATs and infostealing malware, ultimately compromising at least 30,000 devices in over 100 countries. Between December 2025 and July 2026, the attackers exfiltrated data from more than 7,000 cryptocurrency wallets, stealing at least $10.7 million.
What it means for you
If you are exploring remote work or freelance gigs in the crypto space, you are a potential target for similar schemes. The financial loss can be immediate—stolen crypto from a compromised wallet—and the broader impact includes identity theft, blackmail, and the risk of being used as a foothold for further attacks on your employer or clients. Even if the scam does not result in direct theft, the time and effort spent cleaning an infected system can be significant.
What to check / how to judge
- Verify the recruiter’s identity: Look for an official company email address (not a generic Gmail or Yahoo account) and cross‑check the job posting on the company’s own careers page.
- Be skeptical of unsolicited files: Legitimate hiring processes rarely require you to download and run executable files before an interview. If a “coding test” is provided, ask for a link to a sandboxed environment or a repository you can clone safely.
- Use a dedicated device: Keep a separate computer or virtual machine for job‑search activities, especially when handling crypto wallets.
- Enable multi‑factor authentication (MFA): Protect all accounts related to crypto earnings—exchange logins, wallet apps, and email—with MFA to add a layer of security.
- Run reputable security software: Keep your operating system and antivirus tools up to date, and scan any downloaded files before opening them.
- Check for red flags in the job description: Vague company details, unusually high salaries for entry‑level work, or pressure to act quickly are common warning signs.
FAQ
How can I tell if a file is malicious before I open it?
Right‑click the file and view its properties. Look for unexpected file extensions (e.g., .exe, .bat, .js) and check the digital signature. If you have any doubt, upload the file to a free online scanner like VirusTotal, or ask a security‑savvy friend to review it.
What should I do if I think my computer is infected?
Disconnect from the internet immediately, run a full scan with trusted antivirus software, and change passwords for any accounts accessed from the device. If you store crypto on the device, move the funds to a new wallet using a clean, offline computer.
Can I still use freelance platforms safely?
Yes, but treat every job offer with caution. Use the platform’s built‑in messaging system rather than personal email, and never download files that are not hosted on the platform’s secure servers. Review the platform’s verification badges and read reviews from other freelancers.
Are there any signs that a recruiter is actually a state‑backed actor?
State‑backed groups often use sophisticated social engineering, such as impersonating well‑known companies and offering unusually high compensation. They may also request access to your personal devices under the guise of “testing” or “debugging.” If a recruiter asks for remote‑desktop access before any interview, treat it as a major red flag.
This article references reporting from cointelegraph.com.
