- Scam type: Phishing
- Project or site name: Fake crypto-project hiring sites (Celestia, Linea, Berachain and others)
- Incident date: 2026-10-27
- Reported: 2026-10-27
- Last updated: 2026-10-27
Security Alliance (SEAL) reported on 2026-10-27 an ongoing malicious job-interview campaign that arrives through targeted emails and sends people to ClickFix application forms on fake hiring sites for real crypto projects. ClickFix pages ask the visitor to paste a command into Terminal or the Run box, which installs malware. SEAL says the campaign is currently not attributed to North Korea. Fake hiring sites named by SEAL: celestiatalents[.]xyz initiatalents[.]xyz minatalents[.]xyz lineahires[.]xyz movementhires[.]xyz ritualhires[.]xyz seihires[.]xyz workwithbera[.]xyz Lookalikes of crypto…