Crypto Scams Targeting Developers

Recently, I was targeted by a scam that was cleverly disguised as a job opportunity. I am sharing my experience to raise awareness and help others avoid falling into similar traps.

The Approach

It all started with a message on LinkedIn from someone named Harvey Lee, who claimed to be part of a team working on an exciting blockchain project called "Reject Rumble." They praised my profile and expressed interest in my skills.

Initial messages from the scammer.

The Offer

Harvey explained that their team needed help with front-end development for their crypto betting website. They shared a link to a demo project and a repository link where the project's code was hosted.

Details about the project and repository.

https://dicegame-topaz.vercel.app/

The Red Flags

Thanks to my friend Johan Sebastian Baldrich Hinestroza while reviewing the code, He noticed a file named error.js located at authentication/middlewares/helpers/. At first glance, the file seemed harmless, containing typical error handling code. However, on closer inspection, we found extra lines of code with encrypted text for certain functions.

Suspicious code with encrypted text.

https://bitbucket.org/hummer_gg/dice_front-end_user/src/master/

The Malicious Code

The encrypted text was the key to uncovering the scam. The additional code was designed to copy my information using Python. If Python wasn't installed on my system, it would execute a bash script to achieve the same goal. This malicious code aimed to steal sensitive information from my system.

Malicious script intended to steal information.

Protect Yourself

Here are a few tips to protect yourself from similar scams:

1. Verify the Employer: Before engaging with a potential employer, verify their credentials and check if the company is legitimate.
2. Analyze the Code: Carefully review any code you are asked to work on, especially if it is shared through unfamiliar links or repositories.
3. Use Security Tools: Employ security tools to scan code for vulnerabilities and malicious content.
4. Be Skeptical of Urgency: Scammers often create a sense of urgency to rush you into action. Take your time to evaluate the offer thoroughly.

Sharing this experience can help others stay vigilant and avoid falling victim to such scams. Always prioritize your security and privacy when dealing with online job opportunities.