Russian Hackers Are Stealing Crypto Via Fake Job Postings

Using ChainSeeker

Recently, the group promoted a bogus company, ChainSeeker.io, using fake profiles on LinkedIn and job boards like CryptoJobList and WellFound.

Source: LinkedIn

Applicants were directed to download a video-calling app, ‘GrassCall,’ which contained malware that steals wallet addresses, cookies, and passwords from victims’ browsers and Apple Keychain.

More Fake Apps

Once the malware was installed, hackers would brute-force passwords to steal crypto assets from compromised wallets. Reports suggest the criminals make tens of thousands of dollars per victim.

The group has now shifted to using other fraudulent apps, like Gatherum and VibeCall, with similar tactics. After the scam gained attention, job postings for ChainSeeker.io were removed from major job boards.