Scammers Exploit Fake Job Offers With Malware To Target Crypto Wallets

According to Cointelegraph, a cybercrime group known as "Crazy Evil" has been using fake job offers and a malicious app called "GrassCall" to install software designed to steal information from cryptocurrency wallets. The scam, which has reportedly been abandoned, involved creating fake job listings and social media accounts to lure victims into downloading the malware. The group, based in Russia, is composed of social engineering specialists, often referred to as a "traffer team," who focus on targeting the cryptocurrency sector. In January, cybersecurity firm Recorded Future linked over ten active scams on social media to Crazy Evil, noting that the group specifically targets the cryptocurrency space with tailored spearphishing tactics. One of their earlier scams, "Gatherum," was similar to GrassCall, using the same logo and branding to deceive users. Cointelegraph discovered an X account named "VibeCall" that shared the same branding as Gatherum and GrassCall, becoming active in mid-February despite being created in June 2022. Crazy Evil's latest scheme involved a fictitious crypto company called "Chain Seeker," which posted job listings on LinkedIn and popular Web3 job search platforms like CryptoJobsList and WellFound. Applicants were instructed to contact the company's marketing chief on Telegram, who would then direct them to download the GrassCall app from a website controlled by the group. Numerous job seekers recounted their experiences on X and LinkedIn, describing how they applied for positions at Chain Seeker only to receive the malicious link. LinkedIn user Cristian Ghita noted the scam's sophistication, highlighting the presence of a website, social media profiles, and listed employees that made the operation appear legitimate. Despite the removal of most job ads by various job board sites, one listing remained active on LinkedIn at the time of reporting. Chain Seeker's website listed a chief financial officer named Isabel Olmedo and an HR manager named Adriano Cattaneo, both of whom had their LinkedIn profiles erased. However, an account under the name Artjoms Dzalbs remained active, identifying itself as the company's CEO. LinkedIn user Riley Robbins discovered that the supposed executive team used the likenesses of various online personalities. Recorded Future's report last month warned that cryptocurrency and non-fungible token (NFT) traders, as well as gaming professionals, are prime targets for such scams. Users on X and LinkedIn advised those potentially affected by the GrassCall malware to change their passwords and transfer their cryptocurrency to new wallets using an uninfected device as a precaution.