A newly discovered job scam targeting Web3 users is using fake application workflows to deliver cross-platform infostealer malware This article explores malware campaign disguised. . The campaign, disguised as legitimate job-related software, has been found to install sophisticated credential harvesting and wallet-targeting capabilities on both macOS and Windows systems.
This action runs a shell script that moves a hidden executable from a concealed .back directory to /tmp, removes macOS quarantine attributes using xattr -c, and executes the payload silently via nohup. The installer uses Electron and NSIS for packaging, displaying a progress bar that’s actually manipulated to appear legitimate but is driven by random increments once it reaches 80%.
Once this happens, it triggers an internal runUpdate message, which executes a hidden PowerShell command: - Requests administrator privileges via -Verb RunAs - Bypasses execution policies - Launches an unsigned updater.exe file silently This deceptive tactic creates a false sense of legitimacy while initiating malicious activity in the background. Upon execution, both variants concentrate extensively on obtaining sensitive user information, primarily targeting cryptocurrency wallets and authentication systems. By blending deceptive interfaces with advanced data extraction methods, the threat expands beyond individual vulnerabilities to potential organizational breaches through stolen credentials and session tokens.
