Fake job interviews are again being used to breach cryptocurrency teams.

In a documented case, a convincing Web3 recruitment process led a Windows user to install malware that stole private keys, browser data, and other sensitive information.

The operation began with a recruiter contact on LinkedIn, followed by Calendly interviews and a technical assessment presented as a Google Sheet.

Instead of a harmless document, the assessment sent the target toward a signed Microsoft ClickOnce application, a Windows deployment format seen as trustworthy.

Analysts at Have I Been Squatted identified the campaign after a cryptocurrency organization was compromised in July 2026.

The victim’s visible job search created the opening, showing how attackers can tailor a lure around real career changes rather than rely on broad, untargeted spam.

Fake Web3 Interview Uses Signed ClickOnce to Deploy NeedleStealer and hVNC RAT

Have I Been Squatted analysts said in a report shared with Cyber Security News (CSN) that the private keys were compromised and assets were removed across six chains within about an hour.

The attackers later consolidated roughly 22.6 Ether in a staging wallet, while the malware exposed passwords, active browser sessions, cloud tokens, source-control access, and deployment secrets.

Fake Web3 Interview Uses Signed ClickOnce

The fake assessment used a Google Apps Script page that looked like a normal Google-hosted workspace.

It collected details about the visitor’s device and browser wallet extensions, then displayed a connector error that pushed the target to install a supposed Google API helper.

The signed GapiUpdate.application package opened a real Google Workspace page inside WebView2, helping the activity blend into an ordinary work process.

It then contacted attacker infrastructure and downloaded a password-protected archive whose three files were named as PNG images but were Windows executables.

ClickOnce installer for GapiUpdate from gapidriver[.]com, captured from version 1.0.0.182 (Source - Have I Been Squatted) — ClickOnce installer for GapiUpdate from gapidriver[.]com, captured from version 1.0.0.182 (Source – Have I Been Squatted)

Those files ultimately delivered NeedleStealer, a separate Rust-based information stealer, and a Go remote access trojan with hidden virtual-desktop capabilities.

This layered approach matters because a trusted-looking installer can fetch replacement payloads later, reducing the need to sign a new application for every change.

The NeedleStealer branch targeted browser credentials, sessions, wallets, Telegram data, and screenshots.

The Rust stealer broadened the exposure to password managers, VPN and SSH material, developer tools, and cloud configuration.

The campaign fits a wider pattern in which recruitment conversations become the delivery route for malware.

Recent reporting on fake recruiter Web3 attacks shows similar lures aimed at blockchain professionals, while a ClickOnce infection chain report illustrates how the Windows feature can be abused for targeted delivery.

Hidden Access Raises Containment Stakes

The Go RAT gave operators stolen data and remote control. Its recovered capabilities included command execution, file browsing, keylogging, proxying, in-memory execution, persistence, and both visible and hidden VNC.

Hidden VNC can let an attacker operate a separate desktop session without the user seeing the activity on screen.

That access changes incident response priorities. A compromised developer workstation should be treated as an exposure of every credential, session, wallet key, cloud token, source-control token, and deployment secret reachable from that device.

Removing a suspicious application alone is not enough when the attacker may retain remote access.

Teams should verify recruiters independently through official company channels and handle interview software or code in a separate, disposable environment.

ClickOnce SideBySide 2.0 registry writes from the 1.0.0.182 install (Source - Have I Been Squatted) — ClickOnce SideBySide 2.0 registry writes from the 1.0.0.182 install (Source – Have I Been Squatted)

The advice mirrors guidance from coverage of malicious interview coding tests, where reviewing unknown files and isolating assessment material can prevent a personal device from becoming the first point of entry.

Security teams should hunt for ClickOnce activity tied to the listed origin, unexpected WebView2 processes, encrypted archive extraction, executables masquerading as PNG files, and long-lived traffic to the RAT server.

They should isolate suspected hosts, rotate passwords and access tokens, invalidate browser sessions, and move any wallet funds using clean systems and newly generated keys.

The source cautions against attributing the intrusion to a single actor solely from the lure. It notes overlaps with a broader Google Workspace-themed ecosystem, but says the evidence supports a campaign relationship rather than a proven common operator.

That distinction is important as criminals increasingly reuse services, lures, and signed delivery methods.

Indicators of compromise (IoCs):-

Type	Indicator	Description
URL	`https://n-cfjznllwrpfpmyyinhdgwemzxljuukztq3qp73q-0lu-script.googleusercontent.com/userCodeAppPanel`	Google Apps Script lure used for visitor triage and delivery
URL	`https://gapidriver[.]com/installer/GapiUpdate.application`	Signed ClickOnce deployment manifest
URL	`https://gapidriver[.]com/api/get.php`	Authenticated stage-two configuration endpoint
URL	`https://gapidriver[.]com/api/rest.php`	Status-reporting endpoint used after payload dispatch
URL	`https://www.dropbox.com/scl/fi/vwtoo632m1y8sqnm5vplm/Razo.rar?...&dl=1`	Hosted password-protected archive delivered by the stager
Domain	`gapidriver[.]com`	ClickOnce hosting and control infrastructure
Domain	`diegovalanire[.]digital`	NeedleStealer backend
IP address and port	`91.219.238.169:5556`	Go RAT and hVNC command-and-control server
IP address and port	`31.76.7.137:443`	Primary Rust stealer TLS relay
IP address and port	`45.125.67.42:443`	Secondary Rust stealer TLS relay
Domain and port	`vi-yaminnay[.]sbs:443`	Third Rust stealer TLS relay
Network path	`analytics.gif`	Rust stealer relay path
Network path	`pixel.png`	Rust stealer relay path
Network path	`content.js`	Rust stealer relay path
SHA-256	`7866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5`	`GapiUpdate.application` version `1.0.0.201` manifest
SHA-256	`fafa019e18d44a47c615da188d7d56a15364ded87a13e3c405b195b4f48314cd`	`ddsfwef.png`, Rust wrapper for NeedleStealer
SHA-256	`839f6d29d0a0a79bb5ce0a8a0326f3dc8f291ffb87e2c55f68c23a5ed69dbf72`	`eeewr.png`, Rust stealer wrapper
SHA-256	`a7dc0a626d84e17f16d5fc1096e4478298b2a4b61b42a1cf25043cccf846a50a`	`fdsfgweg.png`, Go RAT and hVNC loader
SHA-256	`487f15344db40bca9c8cd853d76cd3e56f15422c9db73e4bc2c2b6c0bcea2806`	Recovered NeedleStealer payload
SHA-256	`112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc`	Recovered Rust `svc` stealer payload
SHA-256	`99c4dcc677942513ff39846aba051d1baeaaa5ad083dabc9e3f9b49a522b0a0a`	Recovered Go RAT and hVNC payload
File name	`GapiUpdate.application`	Malicious signed ClickOnce manifest
File name	`Razo.rar`	Password-protected archive containing payload wrappers
File names	`ddsfwef.png`, `eeewr.png`, `fdsfgweg.png`	PE executables disguised as PNG files
File names	`Launcher.exe`, `GapiUpdate.exe`, `GapiUpdate.dll`	ClickOnce-installed and stager components
Scheduled task	`DeviceSetupManager`	RAT persistence task
Mutex	`Global\\{557C15A4-4040-47C3-B1B6-A6A5B0518BA7}`	Go RAT host mutex
Public-key token	`4ae39df2f018c2be`	Public-key token for analyzed ClickOnce version
Public-key token	`38ce3b33a131dca3`	Public-key token associated with earlier ClickOnce build
Certificate serial	`4D6ABBFC7C052CBAFAA53659971AC471`	Code-signing certificate serial
Certificate SHA-1	`12730A7DD9AF98F14441D476C10EB346708C1194`	Code-signing certificate thumbprint
Authorization token	`Bearer XyZ4pQ9mLwD2TfA7`	Authorization value used for the stage-two configuration request
Archive password	`NSckskj24vd`	Password supplied for extraction of `Razo.rar`

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world

The post Fake Web3 Interview Uses Signed ClickOnce to Deploy NeedleStealer and hVNC RAT appeared first on Cyber Security News.