Scammers are now targeting job seekers with fake job interviews that steal personal information through malicious video calling apps. These scammers are using LinkedIn to post fake job listings, particularly aiming at professionals in the Web3 and cryptocurrency sectors. The scam is sophisticated and involves convincing victims to download a dangerous app during a so-called job interview.
According to cybersecurity experts, a group of cybercriminals is behind this scheme. They are exploiting the growing interest in Web3 and crypto to attract victims. The scammers, part of a Russian-speaking cybercrime group named “Crazy Evil,” post fake job opportunities on LinkedIn and other platforms like WellFound and CryptoJobsList. These listings are designed to look legitimate, often featuring fake company profiles, employee details, and job descriptions that appeal to candidates in the crypto industry.
Once a potential candidate applies for the job, they are contacted by the scammers via email with an invitation to a virtual interview. The email instructs them to connect with the company’s fake chief marketing officer (CMO) via Telegram, where they are persuaded to download a video call app called “GrassCall.” However, the GrassCall app is far from harmless—it is designed to steal sensitive data from the victim’s devices.
On Mac and Windows devices, the GrassCall app installs malware that scans for private information, including bank details, cryptocurrency wallet information, passwords, and other valuable data stored on the device. The malware installed varies depending on the operating system. On Windows, it drops a Remote Access Trojan (RAT) and an info-stealer called Rhadamanthys. For Mac users, it installs a tool called Atomic Stealer (AMOS).
The attackers are reportedly making significant profits from this scheme, as exposed payment details on Telegram show the earnings from each victim. Following the exposure of the scam, CryptoJobsList has removed the fake listings, and the GrassCall website has been shut down. Experts are warning that similar scams are likely to continue as cybercriminals capitalize on the interest surrounding Web3 and cryptocurrency.
Job seekers are urged to be cautious and avoid downloading apps from unknown sources, especially when prompted during job interviews.
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream formerly known as CIO News LinkedIn Account | The Mainstream formerly known as CIO News Facebook | The Mainstream formerly known as CIO News Youtube | The Mainstream formerly known as CIO News Twitter
About us:
The Mainstream formerly known as CIO News is a premier platform dedicated to delivering latest news, updates, and insights from the tech industry. With its strong foundation of intellectual property and thought leadership, the platform is well-positioned to stay ahead of the curve and lead conversations about how technology shapes our world. From its early days as CIO News to its rebranding as The Mainstream on November 28, 2024, it has been expanding its global reach, targeting key markets in the Middle East & Africa, ASEAN, the USA, and the UK. The Mainstream is a vision to put technology at the center of every conversation, inspiring professionals and organizations to embrace the future of tech.
