Singapore police disclose a crypto-related fake recruitment scam that has caused $11.8 million in losses.

Singapore police and the Cyber Security Agency of Singapore (CSA) announced today that a cryptocurrency-related scam involving fake job recruitment and software system intrusions has resulted in $11.8 million in losses. Scammers posed as recruiters from cryptocurrency firms on LinkedIn to approach victims, communicating with them via email addresses using domains similar to those of legitimate companies. They also arranged multiple Google Meet video interviews where cameras were kept off throughout. Victims were then directed to fake websites to complete technical programming tests on company-issued devices, unknowingly downloading malware that stole their session tokens. These tokens were used to bypass multi-factor authentication (MFA) to access Bitbucket accounts linked to the company’s code repositories. After gaining access, attackers modified the company’s automated software deployment commands, remotely accessed its internal servers, and stole credentials to bypass transaction limits and approval checks to execute cryptocurrency transfers. Singapore police and the CSA recommended that tech and cryptocurrency industry enterprises and individuals verify the identities of recruiters and companies, protect API keys and internal credentials, strengthen MFA, and enhance security for code repositories and deployment pipelines. In the event of a suspected intrusion, immediately isolate affected devices, revoke active sessions, reset credentials, and review access logs.