SlowMist Cosine: Job seeker falls victim to "backdoor data theft" while reviewing code, private key directly stolen

According to Mars Finance, SlowMist’s @evilcos has issued a warning that some Web3 job seekers have encountered malicious code traps during interviews. In these incidents, attackers impersonated @seracleofficial and asked candidates to review and run code hosted on Bitbucket. After victims cloned the code, the program immediately scanned all local .env files and stole sensitive information such as private keys. SlowMist pointed out that this type of backdoor is a typical stealer, capable of collecting browser-saved passwords, crypto wallet mnemonics, private keys, and other private data. Experts emphasize that any suspicious code review should be done in an isolated environment, and never run directly on a real device to avoid potential attacks.