Fake Job Campaign Compromises Crypto Org Through Signed Malware
A cryptocurrency organization was compromised after an employee was targeted through LinkedIn while changing jobs. The attacker posed as a recruiter for a fictitious Web3 protocol, arranging interviews through Calendly and sending a technical assessment disguised as a Google Sheet.
The assessment page used genuine Google assets, making it look like a normal Workspace document. It displayed a 'Candidate Verification' prompt and a fake connector error, GAPI-CON-212, telling victims they needed to install a Google API helper to continue.
The helper was not legitimate; it was a signed Microsoft ClickOnce application called GapiUpdate.application, hosted on gapidriver[.]com. Once opened, the installer used Windows ClickOnce components to deploy the malicious application under the logged-in user's profile.