A fake recruiter does not need to beat your firewall if they can convince one employee to install a “helper” during a job interview.

That is the practical lesson from new research by Have I Been Squatted, which analyzed a Windows intrusion chain that began with a fake Web3 interview process and ended with multiple credential-stealing payloads and a remote access tool.

What happened

The reported campaign targeted a cryptocurrency-sector employee who was visibly job hunting. The lure looked normal on the surface: a recruiter contact, interview scheduling, and a technical assessment presented through Google infrastructure. The malicious workflow then pushed the victim toward a Windows ClickOnce application named like a Google API update.

That detail matters. ClickOnce is a legitimate Microsoft deployment mechanism, and the analyzed application was signed. To an end user, the flow can feel less like “I opened a random executable” and more like “I installed the component the interview portal asked for.” That is exactly the trust gap attackers want.

Once installed, the chain displayed a legitimate-looking Google Workspace page while retrieving attacker-controlled configuration and a password-protected payload bundle. The recovered Windows chain ultimately led to three major outcomes:

  • NeedleStealer targeting browser credentials, sessions, wallets, Telegram data, and screenshots.
  • A Rust-based stealer focused on browsers, wallets, password managers, developer tooling, cloud credentials, messaging apps, and files.
  • A Go RAT with hVNC capability, giving the operator interactive access, file management, proxying, keylogging, persistence, and hidden browser interaction.

The source reporting also notes overlap with previously reported fake-interview activity in the crypto ecosystem. Some surrounding infrastructure and tradecraft resemble North Korean cryptocurrency-targeting operations, while other evidence points toward criminal malware-as-a-service and “traffer” ecosystems adopting the same playbook. For defenders, attribution is less important than the operational lesson: job-interview lures are now a mature malware delivery channel, not a novelty.

Why this matters beyond crypto

The cryptocurrency angle makes the wallet theft obvious, but the broader risk is credential blast radius. The payload mix described in the research is not limited to private keys. It reaches for browser sessions, cloud configuration, source-control tokens, VPN and SSH material, password-manager data, and developer tooling.

For SMBs and government contractors, that turns a single compromised workstation into a possible path into Microsoft 365, GitHub, cloud consoles, customer portals, proposal repositories, financial systems, and remote access infrastructure.

The most dangerous part is that the lure does not require a vulnerable public-facing server. It exploits a normal business process: recruiting, contracting, onboarding, vendor intake, freelance interviews, technical assessments, and collaboration with people outside the organization.

Defensive takeaways

1. Treat unsolicited interview tooling as executable risk

Any request to install “assessment software,” “meeting support tools,” “workspace updates,” browser extensions, screen-sharing helpers, wallet tooling, or developer utilities should be treated like a software deployment event, not a casual interview step.

  • Require approval before installing interview or assessment software on work devices.
  • Use disposable virtual machines or isolated test devices for external assessments.
  • Block or alert on ClickOnce execution where it is not explicitly needed.

2. Monitor ClickOnce and per-user install paths

ClickOnce installs into user-controlled locations and can create investigation blind spots if defenders only watch traditional Program Files installation patterns. Endpoint teams should monitor ClickOnce runtime activity, including dfsvc.exe, rundll32.exe loading dfshim.dll, and unusual child processes from ClickOnce application directories.

3. Assume session theft, not just password theft

Stealer incidents should trigger more than a password reset. If browser sessions, OAuth tokens, developer credentials, and cloud configuration were accessible from the host, the response should include token revocation, session invalidation, SSH key review, API key rotation, and repository audit.

4. Segment developer and finance workflows

Developer workstations and finance/admin endpoints carry high-value tokens. They should not be treated like generic laptops. Use stronger endpoint controls, reduce standing privileges, enforce phishing-resistant MFA where possible, and keep wallets, production credentials, and customer data off general-purpose browsing profiles.

5. Build a “weird recruiter” reporting path

Employees need a low-friction way to report suspicious recruiting or contractor outreach without embarrassment. If someone is asked to install a tool during an interview, paste code into a terminal, run a package, or open a signed helper app, they should know exactly where to send it for review.

Bulwark Black assessment

This is the same lesson showing up across modern intrusion cases: identity and endpoint trust are collapsing into one control plane. A signed installer, a real Google page, a convincing recruiter, and a normal-looking assessment process can be enough to put browser sessions, cloud tokens, source code, and financial access in play.

For small teams, the right answer is not “never interview” or “never use outside tools.” The right answer is separation. Keep job-hunting, vendor testing, crypto wallets, admin portals, and production credentials out of the same browser and workstation context. Put friction around new software execution. Watch the child processes that follow trusted installers. And when an infostealer is suspected, respond like tokens were stolen — because they probably were.

Original source: Have I Been Squatted — From fake interview to signed ClickOnce: inside a three-payload Windows chain