Malware from fake jobs, games and "beta tester" offers

Some of the most damaging attacks on crypto users do not involve a phishing site at all. They involve convincing you to run something on your computer. Once malware is running, it can steal wallet files, browser-saved passwords, session cookies and seed phrases from screenshots or notes.

Common lures

• Fake job interviews. A recruiter offers a well-paid crypto role. As part of the process you are asked to clone a code repository and run it, complete a "coding test", or install a specific video-call app. Security researchers have documented campaigns of this type linked to state-sponsored groups targeting crypto developers and workers.
• "Test my game" or "try our beta". A friend's hacked account, or a stranger, asks you to test a new blockchain game or app, with a download link.
• Fake meeting software. A "partnership call" requires downloading a meeting app from a link instead of using a well-known service.
• Pirated software and cheats, including cracked trading tools, that come bundled with infostealers.
• "Fix" commands. A website or chat tells you to paste a command into your terminal, PowerShell or the Run dialog to "verify" yourself or fix an error. This is a fast way to install malware.
• Documents and archives sent as "contracts", "tokenomics" or "invoices" that contain executables or macros.

How to stay safe

1. Never run code, scripts or installers from strangers, even as part of a job process. Legitimate employers use well-known testing platforms and do not need you to run their repository on your personal machine.
2. Do not paste commands from websites or chats into a terminal or the Run box.
3. Use well-known meeting software from its official site. If someone insists on a special app, decline.
4. Keep crypto off your general-purpose computer if you do a lot of downloading, testing or gaming. A separate device or user account for crypto helps. See device hygiene.
5. Use a hardware wallet so keys are not stored on the computer at all.

If you ran something suspicious

• Disconnect the computer from the internet.
• From a different, clean device, move funds from any wallet whose seed or keys were on that computer to a new wallet. Hardware wallet funds are safer, but check the seed was never stored on the computer.
• Change passwords and log out all sessions for email, exchanges and social accounts from the clean device. Stolen session cookies can bypass 2FA until the session is ended.
• Wipe and reinstall the infected computer, or have a professional do it.

See I've been hacked.