COVERTCATCH: Job Scam Malware

[TravelMug]

We have heard news about the social engineering attacks coming from North Korea, but we really don't know how they do it. But recently their exploits was exposed on how they to do it.



1. First you will see this kind of conversation from LinkedIn, as you can see there is a Zip file and obviously this contains the malware - COVERTCATCH
2. Second if you are entice and wanted to apply for that job, they will ask you to download this Zip file onto your system
3. The supposedly Zip file contains the Python coding test that you need to pass
4. However, if you have downloaded, it contain the second stage of the payload

And so it will gather everything from you system, that includes cryptocurrency wallets and other personal info including banking as well. So if you are looking for a crypto related job and someone ask you to download and install a Zip file for a supposedly test, think again as you might be another victims from this cyber criminals.

This is attack though has been found to target MacOS.

https://cloud.google.com/blog/topics/threat-intelligence/examining-web3-heists/

[hd49728]

1. First you will see this kind of conversation from LinkedIn, as you can see there is a Zip file and obviously this contains the malware - COVERTCATCH
2. Second if you are entice and wanted to apply for that job, they will ask you to download this Zip file onto your system
3. The supposedly Zip file contains the Python coding test that you need to pass
4. However, if you have downloaded, it contain the second stage of the payload

Summarize it, we will see a basic hook used by scammers. They provide us something interesting, relates to jobs, money, profit as a hook. If we fall to this, we will take risk and do things like clicking on a phishing link, download a malicious file.

Then, when such malicious things are on our devices or browsers and we are interacting with them more, we get infected and our money together with other data will be stolen by scammers.

Basic things to avoid scams are easy: be careful, avoid to be greed, be control of actions we're doing.

[Kemarit]

Thanks for this, I'm a MacBook user so I'm pretty much the target here. Although I'm not looking for a job right now that relates to crypto, but still this is very dangerous for those who are seeking as some of them could have been desperate already. And so when they see this ads or if by chance they have been contacted, they won't have any doubts and simply download it and then they falls victims for it.

And this criminals knows how to play with our emotions and psychology and that makes this very dangerous.

[sokani]

Some months ago, a forum member shared how he was almost tricked into downloading a malicious file on his PC by a scammer after applying for a moderating job on discord. So this post does not come to me as a surprise, these midwits are everywhere and are always coming up with different tricks to rip off unsuspecting crypto users. LinkedIn, like every other social media platform is filed with scammers and we've to be extra careful. It will be wise to always run files from unknown strangers on virustotal or similar services before downloading them on your PC.

[Davidvictorson]

I quickly checked my LinkedIn messages because I usually receive cold messages from recruiters and all sorts of people which I really pay attention to. None of the messages in my inbox are related to crypto jobs. In my estimation, the target group for this this type of attack would be people who have something to do with tech, crypto, programming, AI. Still there is a likelihood that they may devise a method for business people who are also into crypto  partly. It is a rule of thumb for me not to open any link, talk less of download a file whose source I don't know, expect or trust. If you can't send it as a plain text or on a secure and popular platform then forget about it.

[Baofeng]

I quickly checked my LinkedIn messages because I usually receive cold messages from recruiters and all sorts of people which I really pay attention to. None of the messages in my inbox are related to crypto jobs. In my estimation, the target group for this this type of attack would be people who have something to do with tech, crypto, programming, AI. Still there is a likelihood that they may devise a method for business people who are also into crypto  partly. It is a rule of thumb for me not to open any link, talk less of download a file whose source I don't know, expect or trust. If you can't send it as a plain text or on a secure and popular platform then forget about it.

Most likely this is the case for this one, it's specific niche, targeted for crypto related jobs, It might not be new, but it's a complete twist as they are targeting individuals who are jobs seekers from the crypto industry, which make it very dangerous to us.

Yeah, another twist of this method might target higher management as well. As we all know that CEO and other top tier managers is already in this social media, the biggest and largest professional network. So this is very dangerous for crypto industries as the attack is very bold.

[Nwada001]

Thanks for the information. LinkedIn used to be a very nice place for job seeking before, but now it appears that this is the place where the scammers are operating the most since it's very easy for them to identify their targets in bulk without stress by just using the public information they provide.
 
Imagine trying to look for a job online and end up getting your wallet drained out. The scammers are just getting smarter day after day with new logic to portrait their victims.

[nakamura12]

Although it is been advised to many people that we shouldn't download files carelessly as it might contain malware. When I see a zip file given by someone is that I don't touch anything at all just to be safe rather than opening the zip or anything like that. Thanks for giving the info by the way although I don't use LinkedIn at all. This may be helpful to someone who is using LinkedIn so if I found someone who use it and looking for a job then this is what I will share to make them aware of such tactic.

[Ever-young]

Although it is been advised to many people that we shouldn't download files carelessly as it might contain malware. When I see a zip file given by someone is that I don't touch anything at all just to be safe rather than opening the zip or anything like that.

If you are looking for a job, your mind won't go to that side of suspecting that a file that's sent to you that is supposedly supposed to contain information about the job you are applying for is risky and dangerous. You might just rush and open it without giving it a second thought; after all, you are the one that needs a job from the company or the person in the first place.

[acroman08]

is it weird that I thought they'd do more sweet talking or give more information about the job they are trying to offer rather than just being far more direct like this 😂.

anyway, anyone who at least id familiar with basic cyber security would know that this is a redflag and should be repoted and ignored. that being said, I wouldn't be surprised if there are people fall for this.

[joniboini]

is it weird that I thought they'd do more sweet talking or give more information about the job they are trying to offer rather than just being far more direct like this 😂.

I'm sure they have templates that are better than this. That being said, I'm not surprised if they believe this is enough to trick newbies unfamiliar with their modus operandi. I have a friend who got cheated and gave their OTP to a random scammer because the voice sounds quite professional. Some people are just that reckless IMO.

I tried to apply for a new job recently, and most of them put their guidelines as a doc or PDF files. If you're unfamiliar with how online interviews work, it's very easy to mistake whether a link is malicious or not. CMIIW.

[avp2306]

is it weird that I thought they'd do more sweet talking or give more information about the job they are trying to offer rather than just being far more direct like this 😂.

anyway, anyone who at least id familiar with basic cyber security would know that this is a redflag and should be repoted and ignored. that being said, I wouldn't be surprised if there are people fall for this.

But not everyone is aware about new hacking method currently running and I remember North Korea's hacking activity similar like this https://www.newsweek.com/north-korea-fake-job-offers-cyptocurrency-fbi-1948485

So with this they are now targeting job seeker they should be aware that malwares and anything hacking attempt is now happening in that areas. And people should not download any unfamiliar files especially when it came to random people. If they can't avoid to look at the files sent to them, its better to have other alternative device which doesn't have any important details then use it to open up those unknown links and with this we can assure safety of our important data's.

[lovesmayfamilis]

You can ask these "employers" if it is possible to upload their files to a virtual machine. After which you will hear thousands of denials, since such unpacking is not profitable for them, but for you, it will be a good flag warning you that you are dealing with scammers.

[hd49728]

Scam with job offer that is used as a mean to spread phishing links and malicious files to make your devices infected and steal your accounts, and money, cryptocurrency is more popular nowadays.

In this example, you can see a similar threat with job offers and links in Discord.
Discord & scammers. Check user IDs and user colors of strangers send you PMs
[SCAM] Hiring Discord Moderator from @Saruc

ryzaadit was scammed and lost access to his Discord account but he was still lucky enough by not losing his money.

[Yaunfitda]

You can ask these "employers" if it is possible to upload their files to a virtual machine. After which you will hear thousands of denials, since such unpacking is not profitable for them, but for you, it will be a good flag warning you that you are dealing with scammers.

Possible, but not sure if those who are looking for a job will have this mind and ask them. Or if they have suspecting something, then they shouldn't tell them that they are going to upload the files in the VM and see what's their reaction about it. And this could be the latest trend, or maybe we have heard this before but we don't know how this North Korean scammers works.

Now, they are exposed and hopefully, those job seekers will have to think and used their logical mind as this is a possible scam trick being pulled on them. We know the urgency that we need a job right away, but please we should be at least aware of this kind of Job scam malware, or have this in the back of our mind when applying online.

[CryptSafe]

Thanks alot for sharing this information. It seems this post was meant for me to see for myself. Of lately I have been receiving job offers from some random site and individuals via email and my social media accounts with links attached instructing me to download fill and upload again to the link they provided for me via the same email and funny enough, i do not recognizes such . I am not a novice neither am I new to the system,  I am exposed and well learned enough to be able to decipher a scam and legit stuff. We just ought to be more careful how we attend to mails these days because of their trickish and cunning ways to get at people. Avoid clicking links you have no idea about and always discard unwanted mails to the junk or trash box for your safety.