Fake Recruiter GitHub Repo Targeted Blockchain Developers With Multi-Stage Malware

A cyber campaign targeted blockchain developers through a fake recruitment process that directed victims to a polished GitHub repository posing as a legitimate company project. Investigators found multiple hidden compromise paths in the codebase, including a malicious VSCode task that could run when the folder was opened and a trojanized npm dependency that delivered another infection route. The operation used a multi-stage chain with short-lived JWTs, behavior-based filtering on command-and-control infrastructure, and anti-analysis measures designed to frustrate defenders.

Analysis of the repository’s 574 commits uncovered four malicious artifacts and showed how the attackers blended social engineering with developer tooling abuse to gain execution on targets’ machines. Researchers reported that AI-assisted review significantly accelerated static analysis and helped reconstruct the attack chain, while human validation remained necessary to correct false assumptions during investigation, including the discovery that failed second-stage requests were tied to User-Agent filtering that expected an npm-like fingerprint rather than simple IP-based blocking.