CSA: S$15M lost in cryptocurrency scams using fake job offers by scammers posing as recruiters; victims are tricked into downloading malware through fake technical assessments
Fake recruiters lure job seekers into malware traps through technical tests, giving scammers access to company systems and cryptocurrency transfers This article ( CSA: S$15M lost in cryptocurrency scams using fake job offers by scammers posing as recruiters; victims are tricked into downloading malware through fake technical assessments ) first appeared on The Independent Singapore News .
Singapore authorities have issued a warning about a new cryptocurrency scam that uses fake job offers to launch cyberattacks. According to the Singapore Police Force (SPF) and the Cyber Security Agency of Singapore (CSA), the scam has led to losses of about S$15 million (approximately US$11.8 million).
The scamsters approach victims, often on LinkedIn, posing as recruiters from cryptocurrency firms. They engage in conversation via email and arrange interviews via video calls, often with the camera off. The recruitment process seems legitimate. However, the real attack begins with a technical assessment, hosted on a fraudulent website. The victim, usually on a company-issued device, completes the assessment and unknowingly downloads malicious software.
This software provides the scammers with a way to bypass security measures. They then gain access to internal company credentials and use them to conduct cryptocurrency transactions. This scam is more sophisticated than a simple fake job offer because it aims to compromise a company's systems rather than just trick someone into sending money.
Businesses, especially those in the technology and cryptocurrency sectors, are advised to verify recruiters and companies before allowing applicants to download software or access internal systems. Companies should also strengthen their cybersecurity measures by securing API keys and internal credentials, strengthening multi-factor authentication, and securing code repositories and deployment systems.
In the event of a suspected compromise, businesses should immediately isolate the affected device, revoke active sessions, reset stolen credentials, and check access logs for unusual activity. They should also review accounts, code repositories, internal servers, and approval processes for unauthorized changes. It is emphasized that a job applicant should never allow a technical test to become a free pass into a company's systems.
Written by urgent.news from The Independent Singapore's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
