I installed the fake recruiter's "app." Here's what it actually went after.
Ok so this happened about a year ago. I haven't posted about it because I was embarrassed, and I'm finally past caring about that.
I fell for one of these. Not a junior dev. I build in crypto and I figured I was the last person who'd get caught by a job scam.
A recruiter walked me through their process and asked me to install an app on my Mac. It wanted my user password.
Something felt off. I typed it in anyway, because I was out of work at the time and wanted the job badly enough to talk myself past it.
Once it had admin, it went after:
- my Chrome profile data
- my Chrome extensions, wallet ones included
- wallet private keys of cos
- passport and ID photos sitting on the machine
It staged all of it in one folder that wasn't hidden well. That's the only reason I caught it. Then it almost certainly phoned home.
I moved every asset out of every wallet extension into fresh ones inside the hour, then wiped the machine.
Never trusted it again, sold it second-hand later.
I lost nothing. That's luck, and luck isn't a security model.
The part I want to say out loud: it didn't beat my technical judgment.
It beat my job search. I saw the red flag and went through it because I needed the role.
That's the real exploit, and it's why "just be more careful" is worthless advice for anyone actually looking for work.
A year of saying nothing about it didn't help anybody.
So if one of these has come at you, post what they sent.
The repo, the app, the profile.
The more of it that's searchable, the fewer people run the installer.