Binance says attackers used a fake recruitment process to compromise an engineer’s computer, exploit internal AI tools and stolen credentials, and ultimately gain access to wallet-signing services. The campaign began with job interviews arranged through a legitimate employment platform and culminated in the deployment of a container and an unauthorized transfer on October 29.
A fake hiring process
In September, an engineer received a message through a legitimate job-search platform. The sender posed as a project director seeking to hire an employee and arranged an initial interview with an alleged human-resources representative, followed by a second interview with the supposed CEO of a fictitious company.
During the first interview, conducted through a video platform, the alleged HR representative shared social-media accounts containing personal photos and videos. The second interview took place through a social-chat application. The engineers were then instructed to download an “issue” that linked to a code repository containing malicious code. The code was eventually executed on the engineer’s device during the setup process.
“The malware employed sophisticated obfuscation and evasion techniques, including replacing legitimate development tools components with malicious versions, in order to execute commands and establish communication with external servers controlled by the attackers,” Binance said. “At the time, zero-day malware was not detected by endpoint security protection tools. Attackers took steps to hide their malicious activity and remove any evidence of compromise, making detection and subsequent investigation more difficult.”
Access spreads to other devices
On October 20, the attackers used the compromised engineer’s computer and internal AI tools to take control of two other engineer devices. One of those devices had previously been targeted by a trojanized Homebrew installer. The engineer’s wallet contained a token that granted access to the container deployment.
Nine days later, between 17:15 and 19:56 UTC, the threat actor logged in to the third engineer’s device and used stolen credentials to launch a script. The script deployed the container and initiated the transfer. The attackers also extended their unauthorized access to internal wallet-signing services, allowing them to complete transactions outside the normal withdrawal process.
Source: arstechnica.com
