Fake Web3 Job Interviews Push “ClickFix” Malware

How the attack worked

The campaign begins with fake recruiter outreach on LinkedIn, Telegram, Discord, or direct email. Attackers pose as recruiters from reputable firms, or invent entirely fictitious web companies, and target developers and administrators with highly lucrative salary packages and prestigious career advancement. Once a candidate engages, they are told the next step is a mandatory skill assessment test and directed to an attacker-controlled online platform.

During the assessment, the portal displays a fake camera or microphone error. To resolve it and continue with the interview, the page instructs the candidate to copy and paste a diagnostic command into their system terminal. This is a ClickFix-style lure: the command actually downloads and installs malware. On Windows systems, this can lead to a PowerShell and curl chain that fetches a ZIP file and loads the PylangGhost RAT. On macOS, victims may receive GolangGhost along with a helper application that attempts to trick users into surrendering their administrative password.

Why it succeeded

The assessment portals are built to manufacture urgency and suppress verification. Countdown timers create psychological pressure, and automated warnings appear if the candidate tries to switch browser tabs, which discourages research into the suspicious behavior of the page. By capitalizing on a candidate's desire to perform well against the clock, the attackers bypass the instinct to pause and question an unusual request.

The pretext also exploits the norms of legitimate hiring processes. Skill assessments, coding tests, and platform-based interviews are common in tech recruiting, so a request to fix a technical error feels plausible rather than alarming.

What to watch for

• A job interview or skill test that asks you to run a terminal or command-line instruction
• Countdown timers or tab-switch warnings designed to discourage pausing or researching
• Recruiter contact via LinkedIn, Telegram, Discord, or email offering unusually high compensation for a fast-tracked process
• Any request, during an interview, to enter an administrative password or install additional software
• End targets that include crypto wallet browser extensions such as MetaMask, Phantom, and TronLink, and password managers like NordPass

How to build resistance

Organizations should train developers, administrators, and anyone using crypto wallets or password managers to treat terminal-command requests during a hiring process as an automatic stop-and-verify moment. Awareness efforts should reinforce that legitimate assessments do not require running system commands or entering admin credentials, and that recruiter identities on professional networks should be verified independently before proceeding. Because personal job searches sometimes happen on company devices, reminding staff not to mix work and personal job-hunting activity can reduce the chance that a personal scam becomes an organizational incident.

Mapping this activity to techniques such as spearphishing via service (T1566.003), user execution (T1204.002), and command and scripting interpreter use (T1059) can help defenders build detection and training scenarios around the same behaviors observed here.

How does the fake Web3 job interview attack work?

Attackers pose as recruiters on LinkedIn, Telegram, Discord, or email and offer high-paying Web3 roles that require a mandatory skill assessment. The assessment portal fakes a camera or microphone error and instructs the candidate to copy and paste a diagnostic command into their terminal, which actually installs malware.

What happens after the malicious command is run?

On Windows, the command chain uses PowerShell and curl to fetch a ZIP file that loads the PylangGhost RAT. On macOS, victims may fetch GolangGhost along with a helper app designed to steal admin passwords.

What data are the attackers after?

The malware targets crypto wallet browser extensions like MetaMask, Phantom, and TronLink, as well as password managers such as NordPass, with the end goal of stealing credentials and digital assets.

What are the warning signs of this scam?

Red flags include unusually high salary offers, countdown timers and tab-switch warnings on the assessment portal, and any request to run terminal commands or enter an admin password as part of a job interview.