Kiran 
A single fabricated recruiter message on LinkedIn was enough to trigger one of 2026’s most elaborate Windows infection chains one that combined a signed ClickOnce installer, three separate malware payloads, and a six-chain crypto heist completed almost entirely within an hour.
In July 2026, an employee at a cryptocurrency organization who had just given notice and was openly job-hunting on LinkedIn was contacted by a fake recruiter representing a fictitious Web3 protocol.
The attacker moved the target through a convincingly normal hiring funnel: LinkedIn outreach, Calendly-scheduled interviews, and a “technical assessment” delivered as a Google Sheet.
Fake Job Interview Delivers Signed ClickOnce Malware
That sheet was actually a Google Apps Script web app hosted on legitimate Google infrastructure, which silently profiled the visitor’s IP, geolocation, browser, and installed wallet extensions (MetaMask, Phantom, Rabby, Keplr, and others) before deciding which payload to serve.
Windows victims received a signed Microsoft ClickOnce application, GapiUpdate.application, carrying a legitimate SSL.com Organization Validated code-signing certificate issued to a real Norwegian entity, BARNEHAGEN GUNHILDS MINNE AS, with no evidence the company knowingly participated.
ClickOnce quietly installed Launcher.exe and GapiUpdate.exe, rendered a convincing Google Workspace decoy in WebView2, and fetched an authenticated configuration from gapidriver[.]com that pointed to a password-protected Dropbox archive, Razo.rar.
Inside the archive were three executables disguised as PNG images. Once unpacked through layered Rust and Go wrappers, an authenticated “Vortex” encryption container, and modified Donut loaders, they resolved into:
- NeedleStealer (Go) – harvesting browser credentials, sessions, wallets, Telegram data, and screenshots
- An unclassified Rust stealer – targeting browsers, wallets, password managers, cloud tokens, SSH/VPN configs, and developer tooling (AWS, Docker, GitHub CLI, Terraform)
- A custom Go RAT with hidden VNC – providing shell access, keylogging, proxying, and persistent AES-256-GCM encrypted command-and-control over a raw TCP port
“What makes this chain dangerous isn’t any single novel exploit it’s the modularity. The signed ClickOnce shell, the payload archive, and the final malware are all interchangeable parts sold or rented independently. That’s the real evolution here: fake-interview lures have graduated from a nation-state signature move into a commodity service any criminal affiliate can plug a stealer into. Defenders chasing ‘North Korea’ as the sole threat actor will miss half the traffic on this exact same infrastructure.”
Investigators confirmed this was direct private-key theft, not approval-phishing; no malicious setApprovalForAll or Permit2 signatures appeared in the wallet history.
Within roughly one hour, the attacker repaid lending positions to free collateral, swapped tokens across multiple chains, bridged proceeds to Ethereum, and consolidated about 22.6 ETH into a staging wallet by the next morning, later distributing funds through rapid multi-address aggregation rather than a mixer.
Cameron Coller and Ben Folland tied the campaign to Security Alliance’s previously documented GAPI_Update ecosystem, associated with Russia-based “traffer” and malware-as-a-service groups that have adopted DPRK-style social engineering.
Separately, researcher Hacker Fantastic identified the exact same SSL.com certificate and an identical SHA-256 loader hash in a parallel ClickOnce credential-theft campaign, reinforcing that this isn’t an isolated incident but part of an active, shared delivery infrastructure targeting crypto professionals.
Security teams should treat any ClickOnce install originating from an unsolicited “interview assessment,” combined with WebView2 decoys and post-install non-browser API calls, as a full compromise event; assume every credential, wallet key, and cloud token accessible from that host is burned.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
