Beware of fake recruitment scams! Hackers launch large-scale attacks targeting AI and crypto companies

【Blockchain Rhythm】A recent wave of serious cyberattacks has come to light. According to information from January 22, after siphoning over $2 billion from the crypto market last year, a notorious hacker group has become active again—this time with a different approach.

The hacker organization called PurpleBravo meticulously orchestrated a large-scale fake recruitment campaign targeting over 3,100 enterprise networks involved in artificial intelligence, cryptocurrency, and financial services. They impersonate recruiters or technical developers, tricking job seekers into completing so-called technical interview tasks—either reviewing code, cloning code repositories, or doing programming exercises. Sounds normal, right? In reality, these tasks are smokescreens; the real goal is to execute malicious code on your computer. It has been confirmed that 20 organizations across South Asia, North America, Europe, the Middle East, and Central America have been compromised.

Even more ironic, these hackers are quite skilled at disguise. They use fake Ukrainian identities to hide their true identities, then deploy two remote access Trojans—PylangGhost and GolangGhost—to steal various credentials stored in browsers. Not enough, they also tampered with Microsoft Visual Studio Code by implanting backdoors through malicious Git repositories, making it almost impossible to defend against.

For Web3 practitioners, exchange employees, and even other tech companies, this is a stark warning. During job hunting seasons, stay vigilant—verify the authenticity of unfamiliar job opportunities first, and ensure code review tasks are conducted through official channels.