Fake Web3 Interview Uses Signed ClickOnce to Deploy NeedleStealer and hVNC RAT

Fake job interviews are again being used to breach cryptocurrency teams.

In a documented case, a convincing Web3 recruitment process led a Windows user to install malware that stole private keys, browser data, and other sensitive information.

The operation began with a recruiter contact on LinkedIn, followed by Calendly interviews and a technical assessment presented as a Google Sheet.

Instead of a harmless document, the assessment sent the target toward a signed Microsoft ClickOnce application, a Windows deployment format seen as trustworthy.

Analysts at Have I Been Squatted identified the campaign after a cryptocurrency organization was compromised in July 2026.

The victim’s visible job search created the opening, showing how attackers can tailor a lure around real career changes rather than rely on broad, untargeted spam.

Have I Been Squatted analysts said in a report shared with Cyber Security News (CSN) that the private keys were compromised and assets were removed across six chains within about an hour.

The attackers later consolidated roughly 22.6 Ether in a staging wallet, while the malware exposed passwords, active browser sessions, cloud tokens, source-control access, and deployment secrets.

Fake Web3 Interview Uses Signed ClickOnce

The fake assessment used a Google Apps Script page that looked like a normal Google-hosted workspace.

It collected details about the visitor’s device and browser wallet extensions, then displayed a connector error that pushed the target to install a supposed Google API helper.

The signed GapiUpdate.application package opened a real Google Workspace page inside WebView2, helping the activity blend into an ordinary work process.

It then contacted attacker infrastructure and downloaded a password-protected archive whose three files were named as PNG images but were Windows executables.

Those files ultimately delivered NeedleStealer, a separate Rust-based information stealer, and a Go remote access trojan with hidden virtual-desktop capabilities.

This layered approach matters because a trusted-looking installer can fetch replacement payloads later, reducing the need to sign a new application for every change.

The NeedleStealer branch targeted browser credentials, sessions, wallets, Telegram data, and screenshots.

The Rust stealer broadened the exposure to password managers, VPN and SSH material, developer tools, and cloud configuration.

The campaign fits a wider pattern in which recruitment conversations become the delivery route for malware.

Recent reporting on fake recruiter Web3 attacks shows similar lures aimed at blockchain professionals, while a ClickOnce infection chain report illustrates how the Windows feature can be abused for targeted delivery.

The Go RAT gave operators stolen data and remote control. Its recovered capabilities included command execution, file browsing, keylogging, proxying, in-memory execution, persistence, and both visible and hidden VNC.

Hidden VNC can let an attacker operate a separate desktop session without the user seeing the activity on screen.

That access changes incident response priorities. A compromised developer workstation should be treated as an exposure of every credential, session, wallet key, cloud token, source-control token, and deployment secret reachable from that device.

Removing a suspicious application alone is not enough when the attacker may retain remote access.

Teams should verify recruiters independently through official company channels and handle interview software or code in a separate, disposable environment.

The advice mirrors guidance from coverage of malicious interview coding tests, where reviewing unknown files and isolating assessment material can prevent a personal device from becoming the first point of entry.

Security teams should hunt for ClickOnce activity tied to the listed origin, unexpected WebView2 processes, encrypted archive extraction, executables masquerading as PNG files, and long-lived traffic to the RAT server.

They should isolate suspected hosts, rotate passwords and access tokens, invalidate browser sessions, and move any wallet funds using clean systems and newly generated keys.

The source cautions against attributing the intrusion to a single actor solely from the lure. It notes overlaps with a broader Google Workspace-themed ecosystem, but says the evidence supports a campaign relationship rather than a proven common operator.

That distinction is important as criminals increasingly reuse services, lures, and signed delivery methods.

Indicators of compromise (IoCs):-

Type	Indicator	Description
URL	https://n-cfjznllwrpfpmyyinhdgwemzxljuukztq3qp73q-0lu-script.googleusercontent.com/userCodeAppPanel	Google Apps Script lure used for visitor triage and delivery
URL	https://gapidriver[.]com/installer/GapiUpdate.application	Signed ClickOnce deployment manifest
URL	https://gapidriver[.]com/api/get.php	Authenticated stage-two configuration endpoint
URL	https://gapidriver[.]com/api/rest.php	Status-reporting endpoint used after payload dispatch
URL	https://www.dropbox.com/scl/fi/vwtoo632m1y8sqnm5vplm/Razo.rar?...&dl=1	Hosted password-protected archive delivered by the stager
Domain	gapidriver[.]com	ClickOnce hosting and control infrastructure
Domain	diegovalanire[.]digital	NeedleStealer backend
IP address and port	91.219.238.169:5556	Go RAT and hVNC command-and-control server
IP address and port	31.76.7.137:443	Primary Rust stealer TLS relay
IP address and port	45.125.67.42:443	Secondary Rust stealer TLS relay
Domain and port	vi-yaminnay[.]sbs:443	Third Rust stealer TLS relay
Network path	analytics.gif	Rust stealer relay path
Network path	pixel.png	Rust stealer relay path
Network path	content.js	Rust stealer relay path
SHA-256	7866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5	GapiUpdate.application version 1.0.0.201 manifest
SHA-256	fafa019e18d44a47c615da188d7d56a15364ded87a13e3c405b195b4f48314cd	ddsfwef.png, Rust wrapper for NeedleStealer
SHA-256	839f6d29d0a0a79bb5ce0a8a0326f3dc8f291ffb87e2c55f68c23a5ed69dbf72	eeewr.png, Rust stealer wrapper
SHA-256	a7dc0a626d84e17f16d5fc1096e4478298b2a4b61b42a1cf25043cccf846a50a	fdsfgweg.png, Go RAT and hVNC loader
SHA-256	487f15344db40bca9c8cd853d76cd3e56f15422c9db73e4bc2c2b6c0bcea2806	Recovered NeedleStealer payload
SHA-256	112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc	Recovered Rust svc stealer payload
SHA-256	99c4dcc677942513ff39846aba051d1baeaaa5ad083dabc9e3f9b49a522b0a0a	Recovered Go RAT and hVNC payload
File name	GapiUpdate.application	Malicious signed ClickOnce manifest
File name	Razo.rar	Password-protected archive containing payload wrappers
File names	ddsfwef.png, eeewr.png, fdsfgweg.png	PE executables disguised as PNG files
File names	Launcher.exe, GapiUpdate.exe, GapiUpdate.dll	ClickOnce-installed and stager components
Scheduled task	DeviceSetupManager	RAT persistence task
Mutex	Global\{557C15A4-4040-47C3-B1B6-A6A5B0518BA7}	Go RAT host mutex
Public-key token	4ae39df2f018c2be	Public-key token for analyzed ClickOnce version
Public-key token	38ce3b33a131dca3	Public-key token associated with earlier ClickOnce build
Certificate serial	4D6ABBFC7C052CBAFAA53659971AC471	Code-signing certificate serial
Certificate SHA-1	12730A7DD9AF98F14441D476C10EB346708C1194	Code-signing certificate thumbprint
Authorization token	Bearer XyZ4pQ9mLwD2TfA7	Authorization value used for the stage-two configuration request
Archive password	NSckskj24vd	Password supplied for extraction of Razo.rar

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world