‘Technical assessment’ was malware: SPF and CSA warn of S$15 million LinkedIn crypto scam targeting tech workers

The Singapore Police Force (SPF) and Cyber Security Agency (CSA) of Singapore have issued a joint advisory warning against a sophisticated S$15 million crypto scam targeting tech workers. The scam was carried out through social engineering, spoofed communications, and a malicious software download during a technical coding assessment on LinkedIn.

The victim was initially contacted by a scammer posing as a recruiter from a cryptocurrency company on LinkedIn. Subsequent communication took place via spoofed email and video interviews on Google Meet, where the interviewer's video was disabled. The victim was led to a fake website for a coding assessment, during which the malware was unknowingly downloaded.

This malware bypassed authentication controls, stole internal company credentials, and enabled cryptocurrency transfers totaling US$11.8 million. The SPF and CSA advise the public to be wary of interviewers refusing to enable video on calls, requests for communication through unofficial platforms, and coding assessments requiring file downloads or code execution from unverified sources.

Technical professionals should be extra cautious, as they are more likely to execute code without questioning its origin. Businesses should implement technical safeguards such as secure storage of API keys and internal credentials, short-lived credentials, multi-factor authentication with additional controls like device binding and anomalous login detection, monitoring for suspicious logins, and strict access controls in code repositories.

Affected individuals can report suspicious crimes to the Police Hotline or the ScamShield Helpline, while urgent Police assistance can be obtained by dialing 999.