Fake Web3 Interview Uses Signed ClickOnce to Deploy NeedleStealer and hVNC RAT

Fake job interviews are again being used to breach cryptocurrency teams.

In a documented case, a convincing Web3 recruitment process led a Windows user to install malware that stole private keys, browser data, and other sensitive information.

The operation began with a recruiter contact on LinkedIn, followed by Calendly interviews and a technical assessment presented as a Google Sheet.

Instead of a harmless document, the assessment sent the target toward a signed Microsoft ClickOnce application, a Windows deployment format seen as trustworthy.

Analysts at Have I Been Squatted identified the campaign after a cryptocurrency organization was compromised in July 2026.

The victim’s visible job search created the opening, showing how attackers can tailor a lure around real career changes rather than rely on broad, untargeted spam.