Since last year, I have been getting strange LinkedIn connections.

After connect added straight away they send messgages with sweety offers about job or colaboration, or request for help and test application.
In all cases application was NodeJs project with malware! That malware collect collect sensitive information about cryptocurrency wallets from your laptop and install more complex malware code (may be some keyloggers or other collectors).

Why they wrote me? Why I am target? Attackers choose blockchain experts, becuase frequently cryptocurrency specialists have access to critical infrastructure of projesct wallets.
I have blockchain experience and involved in some success blockchain projects in the past. For this reason I can be ideal target as any other blockchain expert.

Common name for this type attackers — Lazarus.

DANGEROUS! Don’t run code from this article!

Why I need to post this article?

If you review reports on recent cryptocurrency attacks, you’ll notice that most major successful breaches were connected with Lazarus group. However, articles rarely provide detailed information about the attack methods. Still, if you dig deeper, you can often identify similar attack patterns — may be like desribed in this article. (for example Nexera attack, stolen 1.5 billion dollars from bybit etc.)

In most cases, once the attack is completed, you cannot recover or get your money back. That’s how the blockchain world works. You, and only you, control your funds. If you lose control, no one can help you. Moreover, intruders use mixers, which make stolen funds unrecoverable.

Today, one of the most effective ways to avoid losing funds is to prevent attacks in the first place. The main goal of this article is to demonstrate a real attack example for colleagues in the blockchain space. I believe this analysis can help identify attack attempts and improve security measures.

The second goal is to draw attention to problems in blockchain security:

1. The long delay between attacks and response. I believe that with a more effective notification system, projects could block transactions from ByBit attackers faster.
2. Lack of a dedicated investigative body. There is no official ‘blockchain police’ to investigate such incidents.
3. Insufficient or ineffective security tools. For example, I still receive connection requests from fake LinkedIn accounts. For over a year now, I’ve seen no improvement in this situation.

Ok, now I can describe one of the case in my life.

Example of real attack attempt

On a sunny day, a stranger named Gustian L (his profile may already be blocked — https://www.linkedin.com/in/gustian-l-4051bb271/) sent me a connection request on LinkedIn.

His profile stated he was a Full Stack Engineer and CTO — generally presenting himself as the kindest soul. So why not accept the request?»

After that, I had a conversation with Gustian. I’m sharing this dialogue to demonstrate the typical communication pattern of attackers. I realized Gustian was a hacker from his very first message, and his final reply only confirmed my suspicions.

No, I’m not some expert scam-detector. I’ve just had numerous similar ‘encounters’ on LinkedIn — all following the exact same script.

Let’s look at the conversation:

Let me elaborate about communication pattern:

1. Typically, attackers flatter you by saying what an exceptional developer you are and how skilled you appear. So if someone makes you feel like a uniquely important person without any reasons — be cautious. This is common psychology. However, this particular conversation didn’t follow that pattern.
2. Attackers almost always mention extremely high salaries or perfect working conditions. Sometimes they offer exactly what you want (I suspect they research their targets beforehand by studying profiles or gathering information from other sources). In this case, it was both: salary 120-250k$ and mentions  3m$ and investors from UAE.
3. To make the conversation more realistic, attackers may send you technical documentation about the project, UI/UX designs, or other project details. In that conversation attacker sent link to realistic figma design.
4. The attacker might ask you about smart contracts or other Web3 development topics. This helps them verify that you’re a blockchain developer who could be assigned to profitable blockchain projects or might have a cryptocurrency wallet.
5. The attacker always asks you to complete a simple test task for their project. The task usually simpe. If you try to demonstrate the task on your own project, the attacker will insist on performing the test using their customer’s project instead. Proof of test always requires to run attacker application.
6. Attacker appllication always on nodejs/react. Links on github, gitlab or can zip can be sent.
7. Sometimes the attacker may ask for your colleagues’ contact information. It’s not hard to guess why.

LinkedIn accounts used by attackers may be stolen (as might have happened in my case). If the attacker’s profile includes a company name or link to a company website, in most cases it leads to a basic site with minimal information.

Let’s see what Gustian sent me. I already know what to look for. Typically, malware is hidden at the end of a JSX file as a single line starting with ‘Object.prototype.toString’. Let’s find it.

In this case, the malware is hidden inside an image. Let’s find where the code from the image executes. Try searching for all references to ‘logo.png’:

Git files — it’s not interesting. Skip .git/index. Try to open auth.js and you will see the execution line:

Ok! We understood where is «image» executes. Let’s open malware code for undersaing how it works.

DANGEROUS! Don’t run code from this article!

The «image» conains:

This is obfuscated code. Fortunately, it’s JavaScript, so reverse engineering and code restoration aren’t problematic. I won’t describe the process here — reverse engineering is complex and might be tedious for an article.

If you want to save time, you can reconstruct the core logic or partial code using an LLM service like DeepSeek.com. While LLMs may make mistakes and won’t perfectly reconstruct the code, the output is sufficient to understand the core functionality. Let’s examine DeepSeek’s results:

DANGEROUS! Don’t run code from this article!

Tha main points what code doing

1. Download additional malware code from the attacker’s server. Then execute it on your laptop (unfortunately, I couldn’t download the extra code — I suspect it may contain keyloggers or other sensitive data collectors)
2. Collect cryptocurrency wallets information from your laptop and sends to attacker server.
3. Sometimes malware can works with Linux and Windows.

What can we do next? Let’s recover the attacker’s server IP — the destination where malware sends your data. Unfortunately, DeepSeek couldn’t help us here. After manual reconstruction, we can see this URL:

1. http://185.53.46.38:3000/j/cZXhlYw — url from which additional malware code downloaded
2. http://185.53.46.38:3000/keys — to this url malware send information from your laptop

Next step: we can run Nmap to gather information about the attacker’s server. As you can see, RDP is open. This suggests a Windows system, and Nmap confirms it — we’re dealing with Windows 10.

And let’s see where this server is hosted.:

Try to search in Google: STARK INDUSTRIES SOLUTIONS LTD and get link:

Now we can send a letter to this company to block the attacker and potentially continue the investigation. The best outcome would be for the company to block the attacker’s server and share information with law enforcement and cybersecurity researchers.

Сonclusions

If I had executed this code, I would have lost all my funds. I hope this article helps people in the cryptocurrency world be more cautious. Please be carefull.

LinkedIn isn’t the only platform attackers use to contact you. The approach may vary case by case — I’ve seen contact attempts via Telegram, email, and other channels.

Thank you for your time!

If you wish to contact me:
Telergam: @cromlehg
EMail: cromlehg@gmail.com

If this article was useful and you’d like to support the author:
Eth address — 0xE886DF69dc0cC1eAA2BAd8AFDE942F6cd69Cc264