$11.8M Stolen from Singaporeans via Fake Crypto Job Scams

Singapore's police force and cyber security agency have issued an advisory regarding a scam that has cost victims $11.8 million. The scammers, posing as recruiters for cryptocurrency companies, approach their targets on LinkedIn and then move to email and video interviews.

The attackers use a spoofed domain that closely resembles the real company's, tricking the victim into downloading malicious software on a company-issued device. This malware captures a session token, allowing the scammers to bypass multi-factor authentication and access the victim's Bitbucket account.

From there, they alter the employer's software systems and reach its internal servers, collecting credentials that are used to move funds. The advisory does not name any specific company or attribute the attacks to a particular group.