The “JobStealer” Trojan Hijacking Crypto Wallets via Fake Meetings

Doctor Web reports a targeted JobStealer campaign that lures job-seekers into downloading fake video-conferencing software (macOS .dmg or terminal install) which actually installs a trojan that prompts for credentials and steals data—focusing on ~300 Chromium-based wallet extensions, Telegram files, macOS Notes, and evidence of Ledger/Trezor apps—then compresses and exfiltrates the data to attacker C2; variants and infrastructure indicate Windows support and potential future expansion to Linux/iOS/Android.