$15 million lost in cryptocurrency scam involving fake job offers, compromised software systems
The victim unknowingly downloaded malicious software during a fake technical assessment.
A cryptocurrency scam involving fraudulent job offers and compromised software has resulted in US$11.8 million (S$15.1 million) in losses for a victim in Singapore, according to the Singapore Police Force (SPF) and the Cyber Security Agency of Singapore (CSA). The victim was contacted on LinkedIn by a scammer posing as a recruiter from a cryptocurrency-related firm.
The scammer communicated via email, using a fake domain that appeared legitimate, and conducted video interviews where the video function was disabled. The victim was directed to a fraudulent website to complete a technical coding assessment on their company-provided device, during which malicious software was downloaded.
The compromised account, linked to the victim's company's code repository, allowed the scammer to remotely access internal servers and bypass transaction limits and approval checks. To avoid such attacks, the SPF and CSA advised the public to verify the identities of recruiters and companies via official channels, be cautious of interviewers who refuse to enable their video during calls, and not execute code or download files from unverified sources.
They also recommended performing software scans before using them, protecting API keys and internal credentials with temporary credentials where possible, implementing transaction limits and other safeguards that cannot be bypassed, and strengthening Multi-Factor Authentication with additional controls such as device binding.
Written by urgent.news from Straits Times's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
