A fake Web3 recruiting process recently turned into a full Windows compromise chain: LinkedIn contact, Calendly scheduling, a Google-hosted assessment lure, and then a signed ClickOnce application that delivered credential stealers plus remote-access tooling.

The original research from Have I Been Squatted is worth reading because it shows the modern shape of “interview malware.” This is not just a crypto-wallet theft story. It is a workstation-trust story.

What happened

The reported campaign used a fake recruiter and technical assessment to push a victim toward a Google Apps Script page. That page presented a Google Workspace-style experience, performed visitor triage, and selected a Windows delivery path. The Windows payload was a signed Microsoft ClickOnce application named like a Google API update helper.

Once executed, the chain retrieved a protected archive and unpacked multiple payload branches. The recovered payloads included a Go build of NeedleStealer, an additional Rust stealer, and a custom Go RAT with shell access, file management, proxying, keylogging, VNC/hVNC, in-memory execution, update, and persistence capabilities.

Why this matters beyond cryptocurrency

The visible financial impact was cryptocurrency theft, but the defensive lesson is broader. A compromised developer or finance workstation can expose browser sessions, SSH keys, VPN profiles, password-manager material, cloud credentials, source-control tokens, deployment secrets, and customer data access in one event.

For SMBs and government contractors, that means recruiting workflows now deserve the same controls normally reserved for phishing and supplier access. A “candidate assessment” or “interview helper” can become an initial access path into the business.

Defensive takeaways

  • Treat unexpected ClickOnce installs as high risk. Monitor for .application launches, ClickOnce cache activity under user profiles, and suspicious child processes from browser or document workflows.
  • Separate hiring activity from production access. Recruiting calls, assessments, and test files should run from hardened, non-privileged workstations or isolated browser environments.
  • Assume token theft, not just malware execution. If a developer workstation is infected, rotate source-control tokens, cloud keys, deployment credentials, VPN credentials, browser sessions, and password-manager sessions.
  • Review code-signing trust decisions. A signed installer is not automatically safe. Alert when newly seen signed binaries arrive from unusual domains, cloud storage, or interview-related lures.
  • Hunt for remote-control capability. hVNC and proxy features turn a single workstation into interactive access. Look for unusual raw TCP C2, scheduled tasks, proxy processes, and browser session reuse from odd locations.

Bulwark Black assessment

This campaign shows how social engineering, code signing, trusted SaaS surfaces, and endpoint credential theft are converging. The attacker does not need to break MFA if they can steal the browser session or developer token that already passed it.

The practical response is not “never take recruiter calls.” It is to reduce blast radius: isolate untrusted assessments, restrict privileged tokens from daily-use browsers, enforce device posture for admin access, and rehearse credential rotation as part of endpoint incident response.

Source: Have I Been Squatted — From fake interview to signed ClickOnce: inside a three-payload Windows chain