Singapore crypto job scam costs company $11.8 million

A fake cryptocurrency job offer that infected a company-issued device has led to US$11.8 million in losses after attackers gained access to corporate systems and bypassed transaction controls, Singapore authorities have said. Summary A fake crypto job offer led to US$11.8 million in losses after malware infected a company device. Attackers stole a session token, bypassed multi-factor authentication and accessed the company’s Bitbucket repository. Stolen credentials were later used to bypass transaction limits and approval checks for crypto transfers. Singapore authorities urged firms to secure credentials, code repositories and deployment systems. The Singapore Police Force and Cyber Security Agency of Singapore said on Aug. 14 that the victim was first contacted on LinkedIn by a scammer posing as a recruiter from a cryptocurrency-related company, beginning an interview process that eventually gave the attackers access to the victim’s employer. Communication moved from LinkedIn to email, where the supposed recruiter used a spoofed domain that closely resembled the legitimate company’s address. The victim also attended several interviews through Google Meet, although the person cond...