‘Technical assessment’ was malware: SPF and CSA warn of S$15 million LinkedIn crypto scam targeting tech workers

SINGAPORE: The Singapore Police Force (SPF) and the Cyber Security Agency (CSA) of Singapore have issued a joint advisory warning businesses and individuals, particularly in the technology and cryptocurrency sectors, about a sophisticated scam that resulted in losses of US$11.8 million (S$15 million) through a combination of social engineering, spoofed communications, and malicious software.

The victim was first approached on LinkedIn by a scammer impersonating a recruiter from a cryptocurrency-related company. Subsequent communication took place via email from a spoofed domain that closely resembled the legitimate company’s address.

The victim then attended multiple video interviews conducted over Google Meet, with one significant red flag: The interviewer’s video remained disabled throughout every call. The victim was subsequently directed to a spoofed website to complete a technical coding assessment using their company-issued device.

During the assessment, the victim unknowingly downloaded malicious software. The malware bypassed authentication controls, harvested internal company credentials, and used them to execute cryptocurrency transfers, draining US$11.8 million in the process.

What individuals should watch for

SPF and CSA advise the public to treat several signals as immediate red flags: interviewers who refuse to enable their video on calls, requests to communicate through unofficial platforms or unfamiliar websites, and coding assessments that require downloading files or executing code from unverified sources.

Technical professionals are particularly targeted through malicious coding assignments, as they are more likely to execute code as part of a normal workflow without questioning its origin.

Before responding to any job offer or interview request, verify the recruiter and company through official channels. Spoofed domains that closely resemble legitimate ones are a core tool of these operations.

What businesses should do

For businesses, SPF and CSA outlined several technical safeguards. API keys and internal credentials should be stored securely with access restricted on a need-to-know basis, and short-lived credentials used where possible.

While multi-factor authentication (MFA) remains important, the advisory warns that session token harvesting can bypass MFA, making additional controls such as device binding, anomalous login detection, and short session token expiry windows important complementary measures.

Businesses should also monitor for suspicious logins, unexpected access to accounts or systems, privilege escalation, and unusual outbound network traffic from internal servers. Development and production systems should be segmented where possible to limit lateral movement. Code repositories and deployment pipelines should have strict access controls, with changes to deployment instructions subject to multi-party review.

If compromise is suspected, affected devices or systems should be isolated immediately, active sessions revoked, credentials reset, and access logs reviewed. Internal cybersecurity teams or service providers should be notified without delay.

Anyone with information on such crimes can call the Police Hotline at 1800-255-0000 or submit information at www.police.gov.sg/i-witness. For scam-related queries, visit www.scamshield.gov.sg, call the ScamShield Helpline at 1799, or download the ScamShield app. For urgent Police assistance, dial 999.

Read also: Scammers posing as ICA and China officials have stolen S$6.1 million from 72 victims since January — SPF issues alert