🪙 Fake MetaMask Wallet Malware Steals Crypto from Developers via “Job Interviews”

If you work in crypto, Web3, AI, or software development, this campaign was designed for you.

Attackers are posing as recruiters and delivering malware through fake coding interview assignments. The trap hides inside trojanized NPM packages, turning what looks like a legitimate development test into a full compromise of the victim’s machine — and their crypto wallets.

At the center of this campaign are two malware families:

• BeaverTail – a JavaScript loader and data exfiltration tool

• InvisibleFerret – a Python-based remote access backdoor

Together, they create a multi-stage attack chain capable of stealing credentials, browser data, and cryptocurrency wallet keys.

And the most dangerous part?

The attackers don’t just steal files.

They replace the victim’s MetaMask wallet with a malicious version.

🎯 The Setup: Fake Recruiter, Real Malware

The campaign starts with a familiar scenario.

A developer receives a message from a recruiter offering a job opportunity. As part of the hiring process, the candidate is asked to complete a “technical coding challenge.”

The challenge includes an NPM project repository containing what appears to be normal development code.

But hidden inside the package is a malicious JavaScript loader.

When the candidate runs the project locally, the infection begins.

🧩 Stage 1: Lightweight JavaScript Loader

The first-stage malware performs only three actions:

1️⃣ Retrieve the command-and-control (C2) address
2️⃣ Send a beacon confirming the system is infected
3️⃣ Download the next payload stage

This minimalist design reduces the loader’s detection footprint.

Once activated, it installs files inside a VS Code-related directory, silently installs dependencies via NPM, and launches the next script with Node.js in hidden mode.

The victim never sees it happen.

🧠 Stage 2: Data Discovery and System Profiling

The second-stage scripts begin scanning the system for valuable data.

Files matching high-value keywords are targeted, including:

• wallet

• metamask

• seed

• mnemonic

• keys

• solana

• hardhat

• env

• kdbx

The malware also harvests:

• Browser credentials

• Password manager files

• Cryptocurrency wallet artifacts

This works across Windows, macOS, and Linux environments.

🪙 Stage 3: Trojanized MetaMask Wallet

This is where the campaign becomes particularly dangerous.

Attackers identify whether the victim has MetaMask installed in Chromium-based browsers, including:

• Google Chrome

• Brave

If detected, the malware downloads a malicious MetaMask extension and replaces the legitimate extension directory.

Then it modifies Chrome’s Secure Preferences configuration.

Normally, Chrome blocks tampering with extension settings.

But the attackers generate new HMAC-SHA256 signatures that match Chrome’s validation process.

That means the browser accepts the malicious configuration as legitimate.

The fake MetaMask loads silently.

No warning.

No popup.

No suspicion.

🔓 Credential Theft from the Wallet

Instead of rewriting MetaMask completely, the attackers add a small injected script.

This malicious code hooks into the wallet’s password submission routine.

Every time the user unlocks MetaMask, the script sends:

• The plaintext wallet password

• A URL-encoded version of the password

• The encrypted wallet vault

All transmitted to the attacker’s server.

With both the vault and password in hand, attackers can decrypt seed phrases and private keys offline.

They don’t even need access to the victim’s computer anymore.

They can drain the wallet anytime.

🧬 Stage 4: InvisibleFerret Remote Access

The final stage deploys InvisibleFerret, a Python-based remote access tool.

This backdoor allows attackers to:

• Maintain persistent access

• Execute commands remotely

• Retrieve additional data

• Deploy further payloads

Combined with the wallet compromise, this turns a single developer machine into a long-term espionage asset.

⚠️ Why Developers Are the Target

Developers working in crypto ecosystems hold enormous value.

Their machines often contain:

• Private keys

• Wallet backups

• API tokens

• Infrastructure credentials

• Smart contract code

Compromising one developer can expose entire blockchain projects.

That’s why attackers are shifting from phishing emails to developer supply chain attacks.

🛡 How to Protect Against This Campaign

Security teams and developers should implement the following controls:

1️⃣ Verify Interview Assignments

Never run unknown code directly on your primary workstation.
Use isolated environments or disposable VMs.

2️⃣ Audit NPM Dependencies

Malicious packages often hide inside legitimate-looking dependency trees.

3️⃣ Monitor Browser Extension Changes

Unexpected modifications to extension directories or Secure Preferences files should trigger alerts.

4️⃣ Protect Wallets with Hardware Devices

Hardware wallets significantly reduce the risk of seed phrase theft.

5️⃣ Separate Development and Wallet Environments

Never store production wallet credentials on development machines.

🎯 Strategic Takeaway

The modern cyber battlefield isn’t just email inboxes anymore.

It’s developer ecosystems.

Code repositories.
Package registries.
Technical interview assignments.

Attackers know that if they compromise the developer, they compromise everything the developer touches.

And in the world of crypto?

That often means real money.