Fake Web3 Recruiter Uses Signed ClickOnce to Infect Crypto Worker

A fake Web3 recruiter successfully delivered a signed ClickOnce package to a cryptocurrency employee, which unpacked a Rust credential stealer, a Go‑based hVNC RAT, and a persistent loader, demonstrating how trusted‑looking installers can bypass corporate endpoint security measures, exposing critical private keys and browser data.

What was the attack chain and how did the ClickOnce package work?

The initial vector was a phishing email masquerading as a job interview request for a Web3 recruiter role. The email contained a link to a Google Apps Script assessment that, when executed, prompted the victim to download a signed ClickOnce installer—a technology Microsoft markets for easy deployment of .NET applications.

Because the installer was signed with a legitimate SSL.com certificate, Windows Defender and other endpoint tools treated it as trusted software. Once the user launched the ClickOnce app, it silently extracted three payloads: NeedleStealer (a Rust‑based credential harvester), a secondary Rust stealer targeting wallet files, and a Go‑written hVNC remote access tool that provides full desktop control.

Each component was dropped into the user’s profile directory and registered for persistence via scheduled tasks and registry run keys. The Go RAT also opened a reverse VNC tunnel, allowing the attackers to interact with the victim’s desktop in real time.

Researchers on r/netsec linked the SHA‑256 hash of the Go loader to other campaigns targeting cryptocurrency firms, suggesting a broader operation that shares code and signing certificates across multiple victims.

Why are signed ClickOnce installers especially dangerous for Windows users?

ClickOnce packages are designed to simplify software distribution, automatically handling updates and dependency resolution. When an installer is signed with a valid code‑signing certificate, Windows treats it as authentic, bypassing many heuristic detections that flag unsigned or self‑signed binaries.

Attackers exploit this trust model by obtaining or compromising legitimate certificates—SSL.com is a known public‑key infrastructure provider, and its certificates are widely accepted. The signed status also suppresses warning dialogs that would otherwise alert users to unknown publishers.

Because ClickOnce runs with the privileges of the launching user, a compromised account can grant the malware the same access rights, often including admin privileges on personal machines. This makes it an attractive delivery method for multi‑stage payloads that need to persist and evade sandbox analysis.

How did the attackers target the crypto employee and what social engineering cues were used?

The victim was in a transitional career phase, having submitted a resignation and updating their LinkedIn profile to signal openness to new opportunities. The recruiters leveraged this timing, sending a personalized invitation that referenced recent blockchain projects the victim had contributed to.

By embedding the malicious assessment link within a seemingly legitimate Google Apps Script, the attackers mimicked a common technical screening process used by many tech recruiters. The script requested minimal permissions, which the victim accepted without scrutiny.

Additionally, the email referenced industry‑specific jargon and included a professional‑looking signature, creating a sense of credibility. This combination of relevance, urgency, and authenticity is a classic social‑engineering playbook that reduces user skepticism.

What indicators of compromise (IOCs) can defenders look for?

File hashes of the three payloads have been shared publicly on threat‑intel forums; matching SHA‑256 values on endpoint scans can flag infection. The Go loader’s binary exhibits a unique import table pattern that static analysis tools can recognize.

Network traffic to uncommon VNC ports or outbound connections to known command‑and‑control domains used by the hVNC RAT is another red flag. Analysts have also observed scheduled tasks named with random GUID‑like strings that launch the Rust stealer at system startup.

On the host, the presence of a ClickOnce deployment manifest (.application file) in the user’s AppData folder, especially when signed by an SSL.com certificate not associated with any approved internal software, should trigger an alert.

What should organizations and individuals do to protect against similar scams?

Enforce strict email filtering for recruiter‑related messages and educate staff about the risks of downloading assessment tools from unsolicited sources. Verify recruiter identities through official company channels before interacting.

Implement application control solutions that require explicit allow‑listing for ClickOnce installers, regardless of signature status. Windows Defender Application Control (WDAC) and similar tools can enforce policies based on publisher, hash, or file path.

Regularly rotate and monitor code‑signing certificates, and consider certificate pinning for internal software distribution. Any unexpected use of a public‑facing certificate should be investigated immediately.

Deploy endpoint detection and response (EDR) platforms that can surface anomalous process trees, especially when a ClickOnce process spawns a Go binary or Rust executable. Correlate these events with network alerts for outbound VNC traffic.

What this means for you

If you work in cryptocurrency or any high‑value sector, treat unsolicited recruitment outreach with the same caution you would a phishing email. Verify the legitimacy of any assessment tools before execution, and leverage application control to block unsigned or unexpected ClickOnce installers. Maintaining vigilance around code‑signing certificates and monitoring for the specific payload behaviors described above can dramatically reduce the chance of a successful compromise.

Frequently asked questions

How can I tell if a ClickOnce app is malicious?

Check the publisher information; a legitimate ClickOnce installer should be signed by a known internal certificate. Verify the digital signature with the certificate’s thumbprint, compare the installer’s hash against trusted baselines, and scan the extracted files for known malicious indicators.

Are signed ClickOnce installers always safe?

No. While signing indicates the author’s identity, attackers can obtain or compromise legitimate certificates, making signed installers appear trustworthy. Organizations should enforce allow‑listing policies that consider both signature and the software’s intended purpose.

What steps can I take to secure my Windows machine from recruiter scams?

Enable email security filters, educate users about unexpected recruitment links, and require multi‑factor authentication for any credential‑sensitive actions. Additionally, configure application control to block or prompt for ClickOnce installations that are not explicitly approved.