In September, a separate engineer received messages through a legitimate job-hunting platform he was using. The message came from an individual posing as a project director looking to hire new employees. The purported project director arranged a first-round interview with a supposed HR representative and a second-round interview with the purported CEO of the fictitious company.
During the first interview, conducted over a video platform, the purported HR representative shared a social media account that included personal photos and videos. The second interview took place over a social chat app. During it, the engineer was instructed to download an “assignment” that linked to a code repository containing malicious code that eventually executed on the engineer’s device during the setup process.
“The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server,” Binance said. “The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.”
On October 20, the attackers used the compromised engineer’s computer and an internal AI tool to take control of two other engineer devices, including the one previously targeted with the trojanized Homebrew installer. That engineer’s wallet contained a token granting access to a container deployment.
Nine days later, between 17:15 and 19:56 UTC, the threat actor logged in to the third engineer’s device, used the stolen credential, deployed a container, and activated a script to initiate the transfer. Among other things, the attackers extended their unauthorized access to an internal wallet signing service to complete transactions outside the normal withdrawal process.
