Fake Web3 Interview Uses Signed ClickOnce to Deploy NeedleStealer and hVNC RAT

Threat actors are using fake Web3 recruitment processes to target cryptocurrency professionals with information-stealing malware and remote-access capabilities.

The campaign begins with a convincing recruiter contact on LinkedIn and progresses through Calendly interviews and a technical assessment presented through Google Sheets. The victim is ultimately directed to install a signed Microsoft ClickOnce application that acts as the initial delivery mechanism.

Researchers from Have I Been Squatted identified the campaign after a cryptocurrency organization was compromised in July 2026.

Key Highlights

• Initial lure: Fake Web3 recruitment and technical interview.
• Initial contact: LinkedIn.
• Interview scheduling: Calendly.
• Assessment: Fake Google Sheets/Google Apps Script page.
• Delivery mechanism: Signed Microsoft ClickOnce application.
• Malware: NeedleStealer.
• Remote-access malware: Go-based hVNC RAT.
• Browser credentials and active sessions can be stolen.
• Cryptocurrency wallet information can be targeted.
• Telegram data can be collected.
• Cloud tokens and source-control credentials can be exposed.
• RAT capabilities include keylogging, file browsing, proxying and hidden VNC.
• Cryptocurrency assets were reportedly removed from compromised wallets within approximately one hour.

Initial Access

The campaign begins with a recruiter contacting the victim through LinkedIn.

The attackers create a realistic recruitment scenario and schedule interviews using Calendly.

After establishing trust, the victim receives a technical assessment presented as a Google Sheet.

Instead of providing a normal coding or technical exercise, the assessment directs the victim toward a malicious Google Apps Script page.

Fake Google Workspace Assessment

The malicious assessment is designed to appear like a legitimate Google-hosted workspace.

The page collects information about the victim's:

• Device
• Browser
• Installed browser wallet extensions

The page then displays a fake connector error.

The error instructs the victim to install what appears to be a legitimate Google API helper.

This social-engineering step is used to move the victim from a normal browser session to execution of a Windows application.

Signed ClickOnce Application

The campaign uses a signed Microsoft ClickOnce application named:

GapiUpdate.application

The ClickOnce deployment mechanism helps the malware appear more trustworthy because it uses a legitimate Windows software-deployment technology.

The application also opens a legitimate Google Workspace page inside WebView2, helping the activity blend into the expected workflow.

The signed application subsequently contacts attacker-controlled infrastructure and downloads an encrypted or password-protected archive.

Malicious Payload Delivery

The downloaded archive is:

Razo.rar

It contains three files that use .png extensions but are actually Windows PE executables.

The files are:

ddsfwef.png
eeewr.png
fdsfgweg.png

The disguised executables ultimately deliver two major malware components:

• NeedleStealer
• Go-based hVNC RAT

This layered approach allows the attackers to change the final payload without necessarily creating and signing a new ClickOnce application for every campaign update.

NeedleStealer

NeedleStealer is a Rust-based information stealer.

The malware targets sensitive information stored on the victim's Windows system.

Observed targets include:

• Browser credentials
• Browser sessions
• Cryptocurrency wallets
• Telegram data
• Screenshots
• Password managers
• VPN credentials
• SSH material
• Developer tools
• Cloud configuration
• Cloud authentication tokens
• Source-control credentials
• Deployment secrets

For Web3 developers, theft of wallet information and developer credentials can create significant financial and operational risks.

Cryptocurrency Theft

The compromise resulted in theft of cryptocurrency assets.

According to the reported investigation, private keys were compromised and assets were removed across six blockchain networks within approximately one hour.

The attackers later consolidated approximately 22.6 ETH into a staging wallet.

This demonstrates how quickly stolen wallet credentials or private keys can be converted into financial loss.

hVNC Remote Access Trojan

The second major payload is a Go-based remote access trojan with hidden virtual-network-computing capabilities.

The RAT provides attackers with remote control over the compromised endpoint.

Observed capabilities include:

• Command execution
• File browsing
• Keylogging
• Proxying
• In-memory execution
• Persistence
• Visible VNC
• Hidden VNC

Hidden VNC

The hidden VNC functionality is particularly concerning.

It can allow attackers to operate a separate desktop session without the victim necessarily seeing the activity on their physical display.

This provides attackers with an interactive environment that can be used to:

• Access applications
• Navigate websites
• Manipulate files
• Interact with browser sessions
• Perform additional credential theft
• Access developer tools
• Conduct follow-on attacks

A compromised developer workstation should therefore be treated as a potential compromise of every credential, session, token and secret accessible from that system.

Persistence

The Go RAT establishes persistence through a scheduled task named:

DeviceSetupManager

This allows the malware to automatically execute after system startup or according to the task's configured trigger.

The malware also uses a mutex to identify its execution instance:

Global\{557C15A4-4040-47C3-B1B6-A6A5B0518BA7}

Attack Chain

The observed attack chain can be summarized as:

LinkedIn Recruiter → Fake Web3 Interview → Calendly → Fake Google Sheet → Google Apps Script → ClickOnce Application → Razo.rar → Disguised PE Files → NeedleStealer + hVNC RAT → Credential/Wallet Theft → Remote Access

Detection and Hunting Opportunities

Security teams should monitor for:

• Suspicious LinkedIn-based recruitment lures.
• Unexpected ClickOnce application downloads.
• GapiUpdate.application.
• Unexpected WebView2 processes associated with ClickOnce applications.
• Razo.rar.
• Executables masquerading as PNG files.
• ddsfwef.png.
• eeewr.png.
• fdsfgweg.png.
• Launcher.exe.
• GapiUpdate.exe.
• GapiUpdate.dll.
• Scheduled task DeviceSetupManager.
• Suspicious VNC processes.
• Hidden or unexpected remote desktop activity.
• Browser credential-store access.
• Cryptocurrency wallet access by unknown processes.
• Telegram data access.
• Cloud-token access.
• SSH key access.
• Source-control credential access.
• Suspicious outbound connections to the identified C2 infrastructure.

Recommended Mitigations

1. Independently verify recruiters through official company channels.
2. Do not execute software received during recruitment processes without verification.
3. Conduct coding assessments inside isolated virtual machines.
4. Monitor ClickOnce application execution.
5. Restrict unauthorized application deployment.
6. Monitor WebView2 child processes associated with suspicious applications.
7. Detect executables masquerading as image files.
8. Monitor scheduled-task creation.
9. Protect browser credential stores.
10. Protect cryptocurrency wallets and private keys.
11. Store sensitive development credentials outside general-purpose workstations where possible.
12. Use hardware-backed security keys for critical accounts.
13. Rotate credentials immediately following suspected compromise.
14. Revoke cloud and source-control tokens.
15. Invalidate active browser sessions.
16. Move cryptocurrency assets using a clean system and generate new wallet keys if private-key exposure is suspected.
17. Isolate compromised developer endpoints and perform forensic analysis.

Threat Assessment

This campaign demonstrates the growing risk of recruitment-themed social engineering against Web3 and cryptocurrency professionals.

The attack does not depend on a traditional phishing attachment. Instead, the attacker builds trust through a realistic hiring process and introduces malware as part of a legitimate-looking technical assessment.

The combination of signed ClickOnce delivery, information theft and hidden remote access creates a particularly dangerous attack chain for developers who have access to cryptocurrency wallets, cloud infrastructure, source-code repositories and deployment credentials.

Conclusion

Web3 organizations should treat recruitment and technical-assessment workflows as a potential attack surface.

Employees and candidates should independently verify recruiters, avoid running unknown interview software on production systems and conduct technical assessments in isolated environments.

Security teams should specifically hunt for ClickOnce activity, disguised executables, scheduled-task persistence, browser credential access and unexpected VNC/RAT behavior.