In September, another engineer received messages through a legitimate job search platform he was using. The message came from an individual posing as a project manager looking to hire new employees. The purported project director arranged a first interview with a supposed human resources representative and a second interview with the purported CEO of the fictitious company.
During the first interview, conducted on a video platform, the purported human resources representative shared a social media account containing personal photos and videos. The second interview took place via a social chat app. During this operation, the engineer was prompted to download an “assignment” related to a code repository containing malicious code that ultimately executed on the engineer’s device during the installation process.
“The malware used sophisticated obfuscation and evasion techniques, including replacing a legitimate developer tool component with a malicious version to execute commands and establish communication with an external server controlled by an attacker,” Binance said. “The 0-day malware was not detected by endpoint security protection tools at that time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more difficult.”
On October 20, the attackers used the compromised engineer’s computer and an internal AI tool to take control of two other of the engineer’s devices, including the one previously targeted by the Homebrew installer Trojan. This engineer’s wallet contained a token granting access to a container deployment.
Nine days later, between 5:15 p.m. and 7:56 p.m. UTC, the threat actor logged into the third engineer’s device, used the stolen credentials, deployed a container, and activated a script to initiate the transfer. Among other things, the attackers extended their unauthorized access to an internal wallet signing service to carry out transactions outside of the normal withdrawal process.
Gn bussni
