Fake CrowdStrike job offer emails target devs with crypto miners

CrowdStrike reports a recruitment-themed phishing campaign (discovered January 7, 2025) that impersonates the company to lure job applicants into downloading a fake applicant CRM which silently installs an XMRig Monero miner; the dropper performs sandbox checks, fetches configuration and payload from GitHub, unzips to %TEMP%\System, and establishes persistence via a startup script and registry autostart, while limiting CPU usage to avoid detection. Indicators and mitigation guidance (verify recruiter emails, avoid downloading executables) are provided in the report.