Authorities warn against cryptocurrency-related scams involving fake job offers after US$11.8 million in losses

The malware harvested the victim’s session token, which was then used to bypass multi-factor authentication to gain access to the victim’s Bitbucket account, which was linked to his company’s code repository. 

Bitbucket is a code repository hosting service that developers can use to collaborate on code.

After gaining access, the attackers modified the company’s automated software deployment instructions and remotely accessed the company’s internal servers, said SPF and CSA. They also harvested credentials that allowed them to bypass transaction limits and approval checks to carry out cryptocurrency transfers.

SPF and CSA advised businesses and individuals, particularly those in the technology and cryptocurrency sectors, to adopt precautionary measures.

Some measures include verifying recruiter and company identities, protecting application programming interface (API) keys and internal credentials, strengthening multi-factor authentication and securing code repositories and deployment pipelines.

Should there be a suspected compromise, affected devices or systems should be isolated immediately, active sessions revoked, credentials reset, and access logs reviewed.

Individuals and businesses should notify their internal cybersecurity teams or service providers without delay, and assess whether accounts, repositories, internal servers or approval workflows have been altered.