Fake Job Posting and Malicious File: How Wallets Are Stolen Through a "Test Assignment"

Imagine: disguised as a job posting or test assignment, a stealer gets onto the device and steals data from the browser, extensions, and wallets. Everything on the screen may look familiar, so the dangerous moment is easy to miss.

The main thing to know right away: The key is not to panic and not to try to "fix" the situation with random transfers. First, stop the repeat risk, save the original data, and only then sort out what happened.

How the scheme works

Under the guise of a job posting, they send an archive, repository, test assignment, or an "update" for a call app. Inside may be a stealer that looks for browser data, wallet extensions, key files, and clipboard contents.

In this situation, it is important to separate two things: the attack mechanism itself and what has already happened to the assets. Disguised as a job posting or test assignment, a stealer gets onto the device and steals data from the browser, extensions, and wallets. After an incident, a technical review begins not with guesses, but with a specific operation and its continuation on the blockchain.

What to do if this has already happened

After a suspected infection, do not create a new wallet on the same device. First, isolate the machine from the network, use a clean device to change critical passwords and move assets, and then perform a full cleanup or reinstall.

1. Stop repeating the action that led to the incident: do not sign new requests and do not send additional payments.
2. Save the tx hash, full addresses, network, asset, amount, and time of the operation.
3. Record the correspondence, domain, profile, app, or signing screen — everything that explains the context of the operation.
4. If there is a risk of wallet compromise, move the remaining assets to a new safe wallet without using the exposed seed phrase.
5. If the amount is substantial, it makes sense to trace the further route of the funds and identify service points along the way.

What to save for the review

For this specific topic, it is especially useful to save: the file/archive/repository, the link to the job posting, the launch time, and the list of wallets/accounts available on the device.

For an initial review, prepare the data in one message or file — this reduces the risk of losing an important detail:

• tx hash / txid
• full sender and recipient addresses
• network, asset, amount, and time
• screenshots and correspondence
• domain, profile, or app, if they are related to the incident

What is better not to do

• Do not share the seed phrase and private keys with "helpers" or a "recovery service".
• Do not pay an unknown intermediary a "tax", "insurance", or "unlock fee".
• Do not delete correspondence and transaction history before everything is saved.

Important: a transaction and an address are verifiable on-chain facts. The owner's identity, motive, and legal status should not be automatically inferred from a single graph.

When it makes sense to bring in a specialist

If the amount is substantial, the route has already branched, or exchanges, swap services, bridges, and other services have appeared along it, a manual review helps separate available actions from useless ones. To start, public data is usually enough — private keys are not needed.

Frequently asked questions

Is it enough to delete the suspicious program?

Not always. If the stealer has already run, the secrets could have been sent to the attacker. You need to proceed from what data could have been available during the infection.

Can a confirmed transaction be canceled?

As a rule, no. Further actions depend on the route of the funds and on whether services have appeared along it that can restrict the movement of assets.

Can the fraudster be identified immediately by the address?

No. The blockchain shows addresses and operations. Identity requires additional data: the service's KYC, public sources, case materials, or other confirmations.

In short

Disguised as a job posting or test assignment, a stealer gets onto the device and steals data from the browser, extensions, and wallets. If this has already happened, first stop the repeat risk and save the original data. Then you can review the route and the real points for further action.