\n<\/p>\n
SINGAPORE: A cryptocurrency-related scam involving fake job offers and compromised software systems has resulted in losses of US$11.8 million, the Singapore Police Force (SPF) and Cyber Security Agency of Singapore (CSA) said on Friday (Aug 14).<\/span><\/p>\n In one case, a victim was approached on LinkedIn by a scammer impersonating a recruiter from a cryptocurrency-related company.\u00a0<\/span><\/p>\n The scammer communicated with the victim through email, using a spoofed domain closely resembling the legitimate company\u2019s domain.<\/span><\/p>\n The victim also attended several video interviews on Google Meet, although the interviewer\u2019s video remained switched off throughout.<\/span><\/p>\n Subsequently, the victim was directed to a spoofed website to complete a technical coding assessment on his company-issued device, during which he unknowingly downloaded malicious software.<\/span><\/p>\n The malware harvested the victim\u2019s session token, which was then used to bypass multi-factor authentication to gain access to the victim\u2019s Bitbucket account, which was linked to his company\u2019s code repository.\u00a0<\/span><\/p>\n Bitbucket is a code repository hosting service that developers can use to collaborate on code.<\/span><\/p>\n After gaining access, the attackers modified the company\u2019s automated software deployment instructions and remotely accessed the company\u2019s internal servers, said SPF and CSA. They also harvested credentials that allowed them to bypass transaction limits and approval checks to carry out cryptocurrency transfers.<\/span><\/p>\n SPF and CSA advised businesses and individuals, particularly those in the technology and cryptocurrency sectors, to adopt precautionary measures.<\/span><\/p>\n Some measures include verifying recruiter and company identities, protecting application programming interface (API) keys and internal credentials, strengthening multi-factor authentication and securing code repositories and deployment pipelines.<\/span><\/p>\n Should there be a suspected compromise, affected devices or systems should be isolated immediately, active sessions revoked, credentials reset, and access logs reviewed.<\/span><\/p>\n