An employee at a cryptocurrency organization was serving notice and visibly looking for work. A recruiter contacted the employee on LinkedIn, scheduled interviews through Calendly, and supplied a technical assessment presented as a Google Sheet. Within roughly an hour of the July 13 compromise, private keys were exposed and assets were moving across six blockchains.
Have I Been Squatted reconstructed the Windows intrusion from per-user registry records, a signed Microsoft ClickOnce package, its downloaded archive, three native loaders, and the final payloads. The chain delivered two credential stealers and a Go remote-access trojan with hidden VNC. The source later traced about 22.6 Ether into a staging wallet, but it did not quantify a broader victim population.
The containment boundary extends beyond the wallet. The recovered malware targeted browser passwords and sessions, cloud configuration, source-control credentials, deployment tooling, password managers, VPN and SSH material, messaging data, screenshots, and files. The RAT added shell access, proxying, keylogging, pushed in-memory execution, updates, and persistence.
Familiar checks made the lure credible
The assessment was a Google Apps Script web app. A Candidate Verification panel asked for a name and email address, then showed the error GAPI-CON-212 and a failed platform-component load. That manufactured failure supplied the reason to install a supposed Google API helper.
Several trust cues were genuine services used in a hostile sequence. The sheet sat behind real Google authentication and loaded assets from script.googleusercontent.com/userCodeAppPanel, apis.google.com, and gstatic.com. The page also queried api.ipify.org and ipapi.co to collect network and location context and checked for common browser-wallet extensions. These are legitimate shared services, so their presence is investigation context rather than a global block condition.
The Windows response was GapiUpdate.application, a signed ClickOnce deployment manifest. Opening it invoked rundll32.exe dfshim.dll,ShOpenVerbApplication, followed by dfsvc.exe, Launcher.exe, GapiUpdate.exe, and GapiUpdate.dll. ClickOnce installed the application per user beneath %LOCALAPPDATA%\Apps\2.0 and recorded its deployment identity and origin under the logged-on user’s SideBySide\2.0 registry store.
The application displayed a legitimate Google Workspace page inside WebView2 while the stager inventoried the host and requested configuration from gapidriver[.]com. A valid code signature and a real Google page made the workflow look ordinary. Those cues did not establish that the package was safe.
One archive split three ways
The configuration directed the stager to a password-protected Razo.rar archive hosted on Dropbox. Dropbox was an abused legitimate service. The archive contained ddsfwef.png, eeewr.png, and fdsfgweg.png, but all three were x64 Windows executables.
Each wrapper used encrypted or compressed stages before converging on a final payload. One branch produced NeedleStealer, another produced an unclassified Rust stealer, and the third produced the Go RAT with visible and hidden VNC. The RAT used the DeviceSetupManager scheduled task for persistence and the mutex Global\{557C15A4-4040-47C3-B1B6-A6A5B0518BA7}.
Figure details
The figure begins with a targeted LinkedIn and Calendly recruitment conversation. A Google Apps Script assessment then presents a false connector error and offers a signed ClickOnce application. The per-user ClickOnce process opens a legitimate Google Workspace decoy while GapiUpdate.dll retrieves configuration and a password-protected archive. Three PNG-named executable wrappers separate into NeedleStealer, a Rust credential stealer, and a persistent Go RAT with hidden VNC. Static recovery established this designed chain, while execution of every branch on the victim remained unproved.
The ClickOnce package analyzed in full was version 1.0.0.201. Its manifest SHA-256 was 7866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5, with public-key token 4ae39df2f018c2be. The signing certificate had serial 4D6ABBFC7C052CBAFAA53659971AC471 and SHA-1 thumbprint 12730A7DD9AF98F14441D476C10EB346708C1194.
The report says version 1.0.0.201 was probably not the build that reached the victim. Version 1.0.0.182 best matched the July incident and sandbox observations. The builds shared the GapiUpdate name, the gapidriver[.]com origin, and the decoy behavior, but version 1.0.0.182 used public-key token 38ce3b33a131dca3, contacted /api/rest.php, and carried a different certificate and payload behavior. The retained evidence did not prove that version 1.0.0.201 ran on the victim.
Attribution remains open
The signing certificate names BARNEHAGEN GUNHILDS MINNE AS, a real Norwegian entity. The researchers found no evidence that the organization knowingly participated. Compromised signing access, identity abuse, and fraudulent issuance remained possible explanations. The report does not describe responses from Google, Microsoft, SSL.com, Dropbox, or the certificate subject.
Related reporting points in two directions. Security Alliance described Russia-based traffer and malware-as-a-service operators adopting recruitment lures associated with DPRK campaigns. Hacker Fantastic described a second active ClickOnce chain as DPRK-nexus activity. That second chain used the same leaf certificate and the exact fdsfgweg.png loader hash.
Have I Been Squatted kept the distinction explicit: “The evidence below does not fully resolve which side of it the operator stands on.” Shared lures, a certificate, and one loader tie activity together, but they do not establish a single operator.
The source also separates recovered design from observed execution. It recovered every wrapper and final payload, yet static analysis did not prove that all three branches or every RAT capability ran on the victim. The wallet theft is observed impact. The broader credential and remote-access exposure defines prudent containment scope.
Hunt ClickOnce and rotate secrets
Start with the per-user installation trail. Query process telemetry for rundll32.exe loading dfshim.dll, followed by dfsvc.exe, Launcher.exe, GapiUpdate.exe, or GapiUpdate.dll. On matching hosts, inspect %LOCALAPPDATA%\Apps\2.0 and the user’s SideBySide\2.0 ClickOnce records for the application identity, source origin, public-key token, and certificate.
Search endpoint and network telemetry for these attacker-controlled values:
| Type | Hunting value |
|---|---|
| Domains | gapidriver[.]com, diegovalanire[.]digital, vi-yaminnay[.]sbs |
| IP and port | 91[.]219[.]238[.]169:5556, 31[.]76[.]7[.]137:443, 45[.]125[.]67[.]42:443 |
| ClickOnce origin and API | gapidriver[.]com/installer/GapiUpdate.application, gapidriver[.]com/api/get.php, gapidriver[.]com/api/rest.php |
| Public-key tokens | 4ae39df2f018c2be, 38ce3b33a131dca3 |
| Relay files | analytics.gif, pixel.png, content.js |
| Files | GapiUpdate.application, Razo.rar, ddsfwef.png, eeewr.png, fdsfgweg.png |
| Persistence | DeviceSetupManager, Global\{557C15A4-4040-47C3-B1B6-A6A5B0518BA7} |
| Lure marker | GAPI-CON-212 |
The recovered SHA-256 values are:
7866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5 GapiUpdate.application 1.0.0.201
fafa019e18d44a47c615da188d7d56a15364ded87a13e3c405b195b4f48314c ddsfwef.png wrapper
839f6d29d0a0a79bb5ce0a8a0326f3dc8f291ffb87e2c55f68c23a5ed69db eeewr.png wrapper
a7dc0a626d84e17f16d5fc1096e4478298b2a4b61b42a1cf25043cccf846a50a fdsfgweg.png loader
487f15344db40bca9c8cd853d76cd3e56f15422c9db73e4bc2c2b6c0bcea2806 NeedleStealer
112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc Rust stealer
99c4dcc677942513ff39846aba051d1baeaaa5ad083dabc9e3f9b49a522b0a0a Go RAT and hVNCThe verification test is a joined search across EDR, the logged-on user’s ClickOnce registry store, scheduled tasks, file hashes, certificate telemetry, and network records. The expected clean result is no attacker-controlled origin, published certificate, payload hash, or DeviceSetupManager task associated with this chain.
Any match warrants host isolation and secret rotation from a known-clean system. Revoke browser sessions; replace wallet keys; rotate cloud, source-control, deployment, VPN, and SSH credentials reachable from the host; and review their downstream use. Reimaging removes persistence, but only credential and session invalidation cuts off access already copied by the stealers. The incident is contained when those replacements are complete and post-rebuild monitoring shows no use of the old secrets or listed infrastructure.