Known Scams ░▒▓
Threat intelligence database. Lazarus Group / DPRK campaigns targeting developers.
17 accounts · 30 repos · 34 profiles
Scammer GitHub Accounts
github:0x66ethgithub:0xtunetf7github:metabuildergroup76github:superdev313github:goldencity5019github:webdev771github:donotcare745github:goldy1113github:sebastian4098github:eduales99github:vadym110github:vitalii-nesenenkogithub:hiring-supportgithub:momo-tokengithub:pietroethgithub:trevor9312github:saadfrhan
Fake LinkedIn Recruiters
identities stolen by scammers — the real people are not responsible.
Andressa SantiagoverifiedValentine GiroudeverifiedArnas GolubeckasverifiedVictoria HughesverifiedRaymundo CurielverifiedPatrick TolanverifiedElias CaballeroverifiedGabriel JaraverifiedKrunal SolankiverifiedAli MoghaddamverifiedMaksym TsilenkoverifiedFrancis JacquetverifiedRoman LiakhovychverifiedVitoria Danielle FrancaverifiedMartina Gehrken TrappeverifiedBrian PattersonverifiedJoe CarlinoverifiedMark LarisverifiedKathleen Anays Lewis BarriosverifiedAdam MajorosverifiedAlia MilanoaliasSilas MonteiroaliasLucas Sousa SantosaliasBarbara Isa FerreiraaliasJohn MeltzeraliasJulia ValimaliasLaura RottaaliasDaniel Joseph HolyheadaliasMarianne TotterdellaliasTrevor GreeraliasOleksandr BershedaaliasNaeem MuntasiraliasJerry MilleraliasBill Tinysalias
Malicious Repositories
⚠github:dex-staking-project-ultrax⚠github:challenge-experiment-module⚠github:coinpool-rental-platform1.0⚠github:erc20-token-dapp⚠github:golden-city⚠github:multify_staking⚠github:munity-game⚠github:real-estate-rental-platform⚠github:real_estate⚠github:real_estate_new⚠github:sarostech-assessment⚠github:trend-dev-preproduction⚠github:web3game⚠github:peiko-platform-mvp⚠github:trading_platform_ultrax⚠github:goldencity⚠github:gamestakeverse⚠github:ultrax-dex⚠github:dex-staking-platform⚠github:web3_nextjs⚠github:web3_nextjs_backend⚠github:web3-coin-flip-game⚠github:fullstack-nextjs-marketplace⚠github:express-server⚠github:defi-exchange-test⚠github:landing-web-app⚠github:felina⚠github:ctrading⚠github:demo_race⚠github:metaverse-contract
Fake Interview Platforms
impersonating Willo and others to install malware as "camera drivers".
willointerview.comwilloassess.netwilloassess.comwilloassessment.comwillohiring.comwillotalent.prowillotalents.orgwillotalantes.comwillorecruit.comwillocandidate.comwillo-interview.uswillohiringtalent.orgwtalents.uscrypto-assessment.comblockchain-assess.comhiringinterview.orghiringtalent.prointerviewnest.orgvideoscreening.orgfundcandidates.comvideohirepro.com
C2 / Exfiltration Domains
command-and-control servers where stolen data is sent.
npoint.iopastebin.comrequestbin.netwebhook.sitepipedream.nethookbin.comw3capi.marketingmglcoin.ioflickthebean.onrender.comnvidia-release.orgnvidia-release.uscamera-drive.cloudnvidia-drive.cloudjz-aws.infochainlink-api-v3.comip-api-test.vercel.appvscode-config-settings.vercel.appvscode-load-two.vercel.appvscode-settings-bootstrap.vercel.appvscodesettingtask.vercel.appapi-web3-auth.vercel.appcoredeal2.vercel.app
How the Scam Works░▒▓
1Recruiter contacts you on LinkedInFake recruiter with attractive crypto/Web3 job. Profile looks legit. Sometimes deepfake video — ask them to blink.
2Sends a "technical assessment"GitHub/Bitbucket repo to complete. Uses Google Docs or Notion pages to appear legitimate.
3Victim runs npm installMalicious preinstall/postinstall scripts, poisoned configs, or .vscode/tasks.json that auto-runs on folder open.
4BeaverTail + InvisibleFerretBeaverTail steals browser creds & wallets. InvisibleFerret installs persistent backdoor. Attribution: Lazarus Group / DPRK.
attribution & sources
Lazarus Group / BlueNoroff / APT38 (DPRK state-sponsored). Campaigns: Contagious Interview, Dangerous Password. Connected to billion-dollar crypto thefts.