Fake Recruiters Target Web3 Developers Through Trusted Bitbucket and npm Workflows

Cybersecuritynews •Tushar Subhra Dutta • July 29, 2026

A new wave of job scams is hitting Web3 developers who are simply looking for their role. Attackers pose as recruiters, start friendly chats interviews, and then steer candidates toward a fake meeting tool that feels completely normal for remote hiring. The lure looks polished. Victims are told to install “Relay,” billed as […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fake Job Interviews Used to Distribute Infostealer Malware Targeting Web3 Professionals A cyber campaign has emerged targeting Web3 professionals with fake job interviews to deliver cross-platform infostealer malware. Attackers impersonate recruiters and direct victims to a malicious domain, relay.lc, where they are prompted to install a tool named 'Relay.' This malware is designed to harvest sensitive information, including crypto wallets and passwords. The attack is particularly aimed at Web3 developers who are actively seeking employment. The sophistication of the social engineering tactics used in this campaign raises concerns about the security of remote hiring processes. No specific numbers of affected individuals or organizations have been reported yet. The current status of the attack is ongoing, with warnings issued to potential victims. 2 sources 65

Extracted Entities

Fake Recruiters Target Web3 Developers Through Trusted Bitbucket and npm Workflows

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)