$15 million lost in cryptocurrency scam involving fake job offers, compromised software systems
Sign up now: Get ST's newsletters delivered to your inbox
The victim unknowingly downloaded malicious software during a fake technical assessment, giving scammers access to his and his company’s accounts.
ST PHOTO: GIN TAY
SINGAPORE – A cryptocurrency scam involving fake job offers and compromised software systems has resulted in US$11.8 million (S$15.1 million) in losses, with the authorities advising the public to be vigilant of such a ruse.
In an advisory on Aug 14, the Singapore Police Force (SPF) and the Cyber Security Agency of Singapore (CSA) said the victim was first approached on LinkedIn by a scammer impersonating a recruiter from a cryptocurrency-related company.
Further communication was established via e-mail, with the scammer using a fake domain that looked legitimate, and the victim attending video interviews over Google Meet with the interviewer’s video function disabled.
The victim was then directed to a fake website to complete a technical coding assessment on his company-issued device, during which malicious software was downloaded.
The malware allowed the scammer to gain access to the victim’s account on BitBucket, a repository of software code that programmers may use.
As this account is linked to the code repository of the victim’s company, the scammer was then able to remotely access the company’s internal servers, and bypass transaction limits and approval checks to carry out cryptocurrency transfers, among other things.
To protect themselves against such attacks, the SPF and CSA have advised the public to:
Be careful of people who may impersonate recruiters, employers or business partners. They may target developers and technical professionals through fake assignments to give up information or download malicious code.
Verify the identities of recruiters and companies via official channels. Be careful if interviewers refuse to switch on their video during calls.
Not execute code or download files from unverified sources, and to perform software scans before using them.
Protect API keys and internal credentials, using temporary credentials where possible. Businesses should implement transaction limits and other safeguards that cannot be bypassed.
Strengthen Multi-Factor Authentication with additional controls such as device binding, a security process that links a user account or digital app instance to a specific physical device.
Watch out for suspicious activity in your networks, including unfamiliar devices and unexpected access to accounts or systems.
Those with information on such scams can contact the police at 1800-255-0000, or www.police.gov.sg/i-witness.
