CSA: S$15M lost in cryptocurrency scams using fake job offers by scammers posing as recruiters; victims are tricked into downloading malware through fake technical assessments

Summary

• Cryptocurrency scams using fake job offers caused about US$11.8 million (S$15 million) in losses, Singapore authorities said on Aug 14.

• One victim was contacted on LinkedIn by a fake recruiter claiming to represent a cryptocurrency-related company.

• The victim downloaded malware during a fake coding test, allowing scammers to access company credentials and make cryptocurrency transfers.

SINGAPORE: Singapore authorities have warned businesses and job seekers about a scam that turns fake recruitment into a cybersecurity attack.

The scam has caused about US$11.8 million (S$15.9 million) in losses, according to the Singapore Police Force (SPF) and the Cyber Security Agency of Singapore (CSA).

The agencies described how scammers are using fake job offers to gain access to company systems. The method is worrying because the target may think they are simply applying for a job.

The real attack can begin when they are asked to complete a technical test, Channel NewsAsia (CNA) reported the warning on Aug 14.

Fake recruiters build trust of victims before the attack

In one case, a victim was contacted on LinkedIn by someone posing as a recruiter from a cryptocurrency company.

The scammer then continued the conversation by email. The email used a fake website domain that closely resembled the real company’s domain.

The victim also attended several interviews through Google Meet. The interviewer kept the camera switched off during those meetings.

The recruitment process appeared normal enough to move the victim to the next step: a coding assessment. The assessment was hosted on a fake website.

The victim completed it using a company-issued device and unknowingly downloaded malicious software.

One fake test can open the door to company systems

The malware gave the scammers a way around authentication controls. They then harvested internal company credentials and used them to carry out cryptocurrency transfers.

The process makes this scam different from a simple fake job offer. The aim was more than just to trick someone into sending money.

The victim can instead become an unwitting entry point to a company’s systems, credentials, and digital assets.

The authorities said businesses, especially those in technology and cryptocurrency, should verify recruiters and companies before allowing applicants to download software or access internal systems.

Companies should also protect API keys and internal credentials, strengthen multi-factor authentication, and secure code repositories and deployment systems.

Companies must quickly isolate compromised devices and reset stolen credentials

If a device or system is suspected of being compromised, SPF and CSA advise isolating it immediately. Active sessions should be revoked, and credentials reset. Access logs should also be checked for unusual activity.

Companies should then review accounts, code repositories, internal servers and approval processes for unauthorised changes. The advice requires discipline.

A job applicant may be focused on passing an interview, while a scammer is focused on gaining access. A technical test should never become a free pass into a company’s systems.

The safest approach is to verify the recruiter through an official company channel before downloading anything. A genuine employer should have no problem with that extra check.