Singapore's law enforcement and cyber security authorities have put losses from a scam campaign built on fake cryptocurrency job offers and compromised corporate software systems at $11.8 million (S$15.1 million) — a fraction of the city-state's wider scam problem, which cost victims a record S$1.1 billion across all scam types in 2024, according to police annual figures.

In a joint advisory issued Friday by the Singapore Police Force and the Cyber Security Agency of Singapore, and reported by The Straits Times and Channel NewsAsia, the agencies detailed how scammers posing as recruiters for cryptocurrency companies used bogus job offers to compromise their targets' employers.

According to the agencies, a victim was first approached on LinkedIn by someone posing as a recruiter for a crypto company — a lure that blends in on a platform where unsolicited recruiter outreach is routine and membership runs to more than a billion accounts. The conversation then moved to email, where the sender used a spoofed domain closely resembling that of a legitimate firm. Several interviews followed on Google Meet, with the interviewer keeping their camera off throughout.

The victim was next directed to a spoofed website to complete a technical coding assessment — and did so on a company-issued device, downloading malicious software in the process without realizing it.

That malware captured a session token, the string a service issues to keep a user logged in. Because the token represents an already-authenticated session, presenting it allowed the attackers to bypass multi-factor authentication and open the victim's Bitbucket account, where the company stores and manages its source code. Token theft of this kind is a recognized limitation of conventional MFA, since a hijacked session never triggers a fresh login challenge — one reason security practitioners have pushed phishing-resistant approaches such as hardware security keys.

From there, the agencies said, the attackers altered the employer's software systems and reached its internal servers, collecting credentials that were then used to get around transaction limits and approval checks and move funds.

The advisory does not name any affected company, say where the funds went, or attribute the attacks to anyone. Decrypt has approached LinkedIn for comment and will update this article should the company respond.

A well-documented playbook

The pattern is well documented. Researchers have tracked a long-running operation they call Contagious Interview, in which fake recruiters steer Web3 developers toward malicious code, including more than 300 booby-trapped packages uploaded to the npm registry.

A group known as TraderTraitor has used fake job offers to reach corporate cloud systems rather than individual wallets — an approach one researcher put down to that being where the money sits. Others have posed as recruiters from Coinbase and Uniswap to get targets running commands.

Those campaigns are attributed to North Korean hackers, but the playbook is not uniquely theirs. The Russian-speaking crew Crazy Evil built an entire fake Web3 company, ChainSeeker.io, and advertised blockchain analyst roles to lure applicants into installing wallet-draining malware.

Official guidance

Singapore's agencies advised individuals to verify recruiters through official channels, treat an interviewer who will not turn on their camera as a warning sign, and never run code from an unverified source.

For companies, the agencies recommend securing API keys and internal credentials, strengthening multi-factor authentication, and watching for unfamiliar devices and unusual network activity.

Where a compromise is suspected, they advise isolating affected systems, revoking active sessions, resetting credentials, and reviewing access logs.