LinkedIn Recruitment Phishing Analysis

Author: 23pds & Thinking

Background

In recent years, phishing incidents targeting blockchain engineers have occurred frequently on the LinkedIn platform. Yesterday, we noticed a post published by @_swader_ on X. This experience is actually a microcosm of phishing for blockchain engineer recruitment. Next, let's analyze this case.

 (https://x.com/_swader_/status/1900116168544817589)

Process

According to Bruno’s description, a person claiming to be the project party took the initiative to contact him and sent him a long project introduction:

The content mainly involves a blockchain Socifi Job postings for games and staking smart contract platforms.

Project Overview

The project is a staking smart contract platform based on the Socifi game. Core features include:

• Decentralized Exchange

• Games

• Multi-game community features

• NFTs and Tokens

• Live streaming services

Recruitment Intentions

• Looking for developers to join the project.

• Backend and smart contract developers have been recruited.

• Bruno Skvorc was recommended as project manager/front-end development team leader.

MVP Design

• The sender provided a Figma design link pointing to the MVP v2 version.

Recruitment process

• Background check

• Online programming test

• Technical interview

The recruiter was vague at first, then started calling Bruno, trying to convey a sense of urgency and importance, and immediately provided the repo link: https://bitbucket[.]org/ventionteam/gameplatform/src/main/.

User and time of code submission:

Next, let's analyze the malicious code.

Techniques and tactics

Let's look at the code description:

So is this its real function?

First, take a look at package.json:

No malicious third-party modules were found, and it seems that the attack was not carried out through malicious NPM packages. Let's continue the analysis. When we see server.js, if we are not careful, we may end at line 47, after all, there seems to be nothing unusual at first glance.

However, pay close attention to line 46. What is that? And there is a small horizontal scroll bar, which means there is something on the right! Let's drag it over and take a look:

This is an encrypted malicious payload. What is its specific function? Let's take a look at the code:

(The above picture shows part of the code)

This is encrypted code, and there is more than one layer, base64 encryption.

After running npm start, it will run normally, so what is the use of this payload?

Let's run a test on our virtual machine (professional operation, please do not imitate).

We found that this attack method was obfuscated and decryption was difficult. We directly captured the C2 link through the Hook method:

Successfully captured the malicious IP:

• 216.173.115[.]200

• 95.179.135[.]133

• Malicious request: http://216.173.115[.]200:1244/s/bc7302f71ff3. Interestingly, this malicious request bypassed the monitoring detection of little snitch.

  

  The attacker will download and execute the two files, test.js and .npl.

  

  The .npl Trojan is mainly used to maintain permissions:

  

  This is the decoded content of .npl:

  

  The above code is used to download a Python program named pay. The decoded content is as follows:

  

  test.js is mainly used to steal browser data, such as plug-in wallet data, account passwords saved by the browser, etc.:

  

  (partial fragment of test.js code)

  Decryption (fragment):

  

  

  Finally, according to our analysis, once the victim runs the code, the payload will do the following:

  1. Collect system/environment data (home directory, platform, host name, username, etc.).

  2. Make HTTP requests to remote servers to obtain additional data or payloads.

  3. Write the obtained payloads to the local file system (usually in the home directory).

  4. Execute these payloads using Node's child_process.exec.

  5. Continue to connect back or "echo" system data to the C2 server.

  6. Repeat this activity at regular intervals, keep the heartbeat packet, and try multiple times if the first attempt fails.

  7. Quietly monitor user behavior and prepare for stealing encrypted assets, such as trying to read a specific directory /Library/Keychains/ (macOS key storage path) in the code, stealing SSH private keys, stealing browser plug-in data, and account passwords saved by the browser.

  At the same time, @blackbigswan found the same user:

  • https://github[.]com/DavidDev0219

  • https://github[.]com/vention-dev

  • https://github[.]com/FortuneTechWorld

  The author speculates that they are the same group of attackers and will not make any unnecessary analysis.

  Countermeasures

  Attackers usually send malicious files through Telegram, Discord, and LinkedIn. For this type of phishing attack, we propose the following countermeasures from the perspective of users and enterprises:

  Users

  • Be wary of suspicious recruitment information or part-time jobs that require downloading or running code from platforms such as GitHub. Verify the identity of the sender through the company's official website or official email address first, and avoid believing in misleading rhetoric such as "limited-time, high-paying tasks";

  • When handling external code, strictly review the project source and author background, refuse to run unverified high-risk projects, and it is recommended to execute suspicious code in a virtual machine or sandbox environment to isolate risks;

  • For Telegram and Discord,

  • Enable multi-factor authentication and regularly change high-strength passwords to avoid cross-platform reuse.

  Enterprises

  • Regularly organize employees to participate in phishing attack simulation drills and train the ability to identify counterfeit domain names and abnormal requests;

  • Deploy email security gateways to intercept malicious attachments;

  • Monitor whether sensitive information in code repositories is leaked;

  • Establish an emergency response mechanism for phishing incidents, and reduce the risk of data leakage and asset loss through a multi-dimensional strategy that combines technical protection with personnel awareness.