Unmasking the GrassCall campaign: the hackers behind job recruitment cyber scams

Unmasking the GrassCall campaign: the hackers behind job recruitment cyber scams

Speakers: Dixit Panchal (Quick Heal Technologies), Soumen Burma (Quick Heal Technologies)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=cK0ksoBQKhk

Overview

The "Unmasking the GrassCall campaign" presentation at Virus Bulletin delved into an advanced social engineering campaign primarily targeting the burgeoning web3 and cryptocurrency sectors. Spearheaded by a sophisticated Russian-speaking cybercriminal organization known as Crazy Evil, this campaign leverages elaborate fake job recruitment schemes to deploy info stealer malware. The talk, originally researched by Digshit Panchal and Smen (Quick Heal Technologies) and presented by Satwik and Soumen Burma, shed light on the intricate tactics, techniques, and procedures (TTPs) employed by these threat actors, detailing their infection chain, malware analysis, and the devastating impact on victims.

The GrassCall campaign, first observed in March 2025, represents a significant threat due to its global reach and the substantial financial losses incurred by individuals in the crypto space. By masquerading as legitimate job opportunities from high-level executives, the attackers meticulously social engineer victims into downloading malicious payloads. This detailed exposé is crucial for understanding the evolving landscape of cybercrime, particularly how financially motivated groups exploit human trust and the allure of new opportunities within high-value digital economies.

The research presented not only uncovers the technical mechanics behind GrassCall and its variants like WipeCall and WaveCall but also provides a rare glimpse into the organizational structure and operational methodologies of a prolific cybercriminal enterprise. For security professionals and individuals alike, this talk serves as a critical warning and a guide to mitigating the risks posed by such sophisticated, multi-stage social engineering attacks.

Background

▶ Watch: Introduction to the GrassCall crypto job scam campaign (0:00)

The GrassCall campaign is attributed to Crazy Evil, a Russian-speaking cybercriminal organization that first emerged in 2021. This group operates with a complex, hierarchical structure, employing a network of individuals known as "trafers" who are recruited through dedicated Telegram channels. These trafers are central to Crazy Evil's operations, specializing in redirecting legitimate user traffic to malicious websites and executing the initial stages of their social engineering schemes. The group's primary objective is the theft of identity and cryptocurrency, achieved through the deployment of advanced info stealer malware designed to drain digital wallets and extract sensitive information.

Crazy Evil's operational model is heavily reliant on social engineering, often requiring multiple interactions with victims to establish trust before delivering the final malicious payload. Their recruitment process is highly organized, utilizing Telegram groups like "Abraham crazy evil official" for administration and "crazy evil" for general membership, which boasts over 3,000 members. These channels are used to distribute comprehensive, automated manuals, including audio and visual guides, to new recruits, ensuring consistent execution of their deceptive tactics. Other channels facilitate news dissemination and global chat among members, fostering a collaborative environment for their illicit activities.

The campaign's focus on the web3 and cryptocurrency sectors stems from the high-value assets involved and the often-decentralized nature of these environments, which can present unique vulnerabilities for unsuspecting users. Prior to the detailed analysis of GrassCall, various other info stealer campaigns have targeted these sectors, but GrassCall distinguishes itself through its sophisticated, multi-stage social engineering and the organizational depth of its operators. The initial discovery of the GrassCall campaign is credited to Joan Garcia, laying the groundwork for Quick Heal's subsequent in-depth research and unmasking of the underlying threat actor.

Key Findings

▶ Watch: Crazy Evil: Russian cybercrime group's structure and recruitment (4:20)

The research unveiled several critical findings about the GrassCall campaign, highlighting its sophistication, targeting, and impact.

Firstly, the campaign was initially observed in March 2025, with subsequent identification of variants such as WipeCall and WaveCall. These variants indicate an evolving and persistent threat landscape orchestrated by the same Russian-speaking cybercriminal organization, Crazy Evil, and its subgroup, Kland. The attribution to such a well-organized group underscores the strategic nature and resourcefulness behind these attacks.

Secondly, the primary targets are professionals within the cryptocurrency and web3 sectors, including freelance and remote workers actively seeking new job opportunities. Geographically, the campaign has shown a significant focus on the US and India, which represent large populations of crypto users and job seekers. The threat actors have also expanded their operations to the UK, Germany, Netherlands, and other parts of the EU and the Americas, demonstrating a global reach, notably excluding CIS countries and Russia.

Thirdly, the campaign employs an elaborate, multi-stage social engineering process. It begins with the establishment of fake businesses and professional-looking websites, such as chainseker.io, to advertise fabricated job opportunities across various social media platforms like Twitter and LinkedIn. Victims are then lured into a phishing email exchange, often from spoofed CXO-level executives (CFOs, CMOs), inviting them to schedule an interview via Calendarly. This initial contact then pivots to a Telegram chat, where the crucial social engineering occurs, convincing the victim to download a seemingly legitimate video conferencing tool.

Fourthly, the actual "video conferencing tool" is a malicious executable (video_call.exe) downloaded from fake domains like grasscall.net, wipeall.net, or wavecall.net. A unique aspect is the requirement for a "passcode" to execute the downloaded malware, which the attackers provide to ensure the victim is indeed the intended target and not a sandboxed environment. This step adds a layer of evasion against automated analysis.

Finally, the campaign effectively targets both Windows and Mac users. On Windows, the malware typically deploys Radaman's info stealer, providing remote access and extracting sensitive information. For Mac users, the campaign utilizes Amos stealer, designed for similar data harvesting capabilities. The ability to deploy different info stealers based on the target operating system demonstrates the threat actors' adaptability and comprehensive approach to data exfiltration. The cumulative effect of these attacks has resulted in hundreds of individuals globally being affected, leading to substantial draining of cryptocurrency from victim wallets.

Technical Deep Dive

▶ Watch: Infection Chain: From fake jobs to malware deployment (6:30)

The technical analysis of the GrassCall campaign reveals a sophisticated, multi-layered attack infrastructure designed to evade detection and maximize data exfiltration. The infection chain is meticulously crafted, starting with initial access and culminating in the deployment of potent info stealer malware.

The initial infection vector leverages fake business entities and job advertisements. Threat actors create professional-looking but entirely fabricated websites, such as chainseker.io, which are then promoted across various social media platforms like Twitter, LinkedIn, and Telegram. These platforms serve as a conduit to lure unsuspecting professionals, particularly those in the web3 and cryptocurrency sectors, with enticing job opportunities. Once a victim expresses interest, they receive a phishing email purportedly from a high-ranking executive (e.g., CFO, CMO) of the fake company. This email invites them to schedule a preliminary meeting using a legitimate scheduling service like Calendarly.

The critical pivot occurs after the Calendarly scheduling. The attackers, still impersonating the executive, reach out to the victim and divert the communication to Telegram. This transition is crucial because it allows the threat actors to bypass typical email security controls and engage in more direct, real-time social engineering. On Telegram, the victim is convinced to download a supposed video conferencing tool necessary for the "interview." The malicious files are hosted on attacker-controlled domains such as grasscall.net, wipeall.net, or wavecall.net. These domains are designed to mimic legitimate software download pages, further enhancing the deception.

A unique anti-analysis technique employed at this stage is the requirement of a passcode to execute the downloaded video_call.exe file. This passcode is provided by the attacker only to the intended victim, ensuring that the malware is executed on a live target machine rather than a sandboxed environment or by a security researcher. This measure significantly delays and complicates automated analysis.

Upon execution, the video_call.exe acts as a loader. Analysis using tools like DIIE revealed it to be a C++ binary. Its primary function is to perform several malicious activities:

1. Defender Exclusion: The loader executes commands such as add MP preference to create exclusions within Windows Defender, effectively disabling or weakening its ability to detect subsequent malicious activities.
2. Payload Dropping: It downloads multiple info stealer malware samples from attacker-controlled Command and Control (C2) servers. These downloaded samples are typically dropped into the C:\Users\Documents folder.
3. Execution: The loader then executes these dropped payloads, initiating the second stage of the infection.

The info stealer malware itself, whether Radaman's info stealer for Windows or Amos stealer for Mac, incorporates sophisticated anti-debugging and anti-reversing techniques. These include:

• Process Checks: The malware actively checks for the presence of common debugging and analysis tools, such as IDA 64.exe and x64dbg, along with other reverse engineering and sandbox processes.
• API Calls: It utilizes Windows API calls like IsDebuggerPresent and IsProcessorFeaturePresent to detect if it's running in a debugger or virtualized environment.
• System Enumeration: Before fully executing, the malware performs extensive system enumeration, listing running processes and other system details, which can also be used to identify analysis environments.
• Unpacking: The malware often employs packing techniques, and the analysis revealed that unpacking is performed during execution. Researchers observed this by breaking on VirtualAlloc and inspecting initial registers.

Once unpacked and executed, the info stealer establishes a connection to its C2 server, which is typically identified through configuration files embedded within the payload. These C2 servers, often hosted on domains ending with .work (e.g., .work), are used for further stage downloads and data exfiltration. The info stealers are designed to harvest a wide array of confidential information, including cryptocurrency wallet details, login credentials, browser data, and other sensitive personal and financial data, ultimately draining victims' digital assets. The use of .work domains for spearphishing is a common tactic to appear legitimate in a professional context.

The overarching TTPs observed throughout the GrassCall campaign align with typical financially motivated cybercrime:

• Initial Access: Spearphishing via email and social media.
• Execution: Malicious executable (.exe) delivered through social engineering.
• Persistence: Though not explicitly detailed, info stealers often establish persistence.
• Defense Evasion: Anti-debugging, anti-analysis, defender exclusions, and the passcode mechanism.
• Command and Control: Communication with C2 servers for payload delivery and data exfiltration.
• Exfiltration: Harvesting and transmitting sensitive data, particularly cryptocurrency wallet information.

This comprehensive technical framework demonstrates the Crazy Evil group's capability to orchestrate highly effective, evasive, and damaging cyberattacks against specific, high-value targets.

Demo / Proof of Concept

▶ Watch: Technical Analysis: Anti-debugging and C2 communication (11:30)

While the presentation did not include a live demonstration or a proof of concept of the GrassCall malware in action, the speakers provided a detailed step-by-step walkthrough of the entire infection chain. This included screenshots of fake job advertisements, phishing emails, Telegram chats, and the malicious download websites (grasscall.net). The technical analysis section further elucidated the inner workings of the loader and info stealer components, effectively illustrating how the attack functions from a technical perspective without needing a live execution.

Defensive Implications

▶ Watch: Mitigation strategies: Verifying jobs and using security tools (14:10)

The GrassCall campaign highlights critical vulnerabilities in individual and organizational security postures, particularly concerning social engineering and supply chain attacks masquerading as legitimate recruitment. Defenders must adopt a multi-faceted approach to mitigate the risks posed by such sophisticated operations.

Firstly, rigorous verification of job opportunities and sources is paramount. Individuals should be highly skeptical of unsolicited job offers, especially those promising lucrative positions in the web3 or cryptocurrency sectors. Always cross-reference job postings with official company websites, reputable job boards, and verified LinkedIn profiles. Direct communication should be initiated through official channels, not through unexpected emails or pivots to messaging apps like Telegram. Any request to download custom software for an interview should be treated with extreme caution, as legitimate companies typically use established, well-known video conferencing platforms.

Secondly, exercise extreme caution with all downloads from unverified sources. The campaign's reliance on custom "video call" applications from attacker-controlled domains (grasscall.net, wipeall.net, wavecall.net) is a clear red flag. Users should never download and execute software from unknown websites, even if prompted by someone claiming to be a recruiter. Organizations should implement policies that restrict software installation to approved applications and sources, ideally through centralized IT management.

Thirdly, deploying reliable security tools is essential. This includes robust antivirus software, Endpoint Detection and Response (EDR) solutions, and next-generation firewalls. These tools can help detect and block malicious executables, identify suspicious network traffic (C2 communications), and prevent the execution of known info stealers like Radaman's and Amos. Regular updates of these security solutions are critical to ensure they can identify the latest threats.

Fourthly, conduct regular system checks and security audits. Organizations should implement regular vulnerability assessments and penetration testing. Individuals should routinely check their systems for unusual processes, unexpected file downloads, and unauthorized network connections. Tools that monitor for changes in system configurations and alert on new software installations can be beneficial.

Fifthly, enhance employee security awareness training. Given the heavy reliance on social engineering, educating employees about phishing tactics, imposter scams, and the dangers of downloading unverified software is crucial. Training should include real-world examples of job recruitment scams and emphasize the importance of verifying identities and sources before engaging. Specific training for professionals in high-target sectors like web3 and crypto is particularly important.

Finally, implement strong identity and access management (IAM) practices. This includes enforcing multi-factor authentication (MFA) across all accounts, especially for cryptocurrency exchanges and wallets. Strong, unique passwords should be used for all services. In the event of a compromise, MFA can significantly reduce the impact of stolen credentials. Organizations should also consider Zero Trust architectures, where no user or device is inherently trusted, requiring continuous verification. By integrating these defensive measures, individuals and organizations can significantly bolster their resilience against sophisticated social engineering campaigns like GrassCall.

Key Takeaways

• Sophisticated Social Engineering: The GrassCall campaign leverages advanced, multi-stage social engineering, including fake job ads, spoofed executive emails, and pivots to private messaging (Telegram), to trick victims.
• Targeted Sectors: Professionals in the web3 and cryptocurrency sectors, particularly those seeking new job opportunities, are the primary targets due to the high-value assets involved.
• Global Reach with Specific Focus: While globally distributed, the campaign notably targets the US and India, with expansion into European and American regions, while avoiding CIS countries.
• Multi-OS Info Stealers: The attackers deploy different info stealer malware (Radaman's for Windows, Amos for Mac) demonstrating adaptability and comprehensive targeting capabilities.
• Evasion Techniques: The campaign utilizes anti-analysis measures like requiring a "passcode" for malware execution and incorporating anti-debugging/anti-reversing techniques within the malware itself.
• Organizational Cybercrime: The campaign is orchestrated by a well-structured Russian-speaking cybercriminal group, Crazy Evil, which recruits and trains "trafers" through dedicated Telegram channels.

About the Speaker(s)

The talk "Unmasking the GrassCall campaign" was presented by Soumen Burma and Satwik, security researchers at Quick Heal Technologies. They presented the work on behalf of the original researchers, Digshit Panchal and Smen, who are also security researchers at Quick Heal Technologies' Check Labs. Digshit Panchal, specifically mentioned in the audio clip, focuses on AP research, threat hunting, and malware analysis. The team's collective expertise lies in deep-dive malware analysis, threat intelligence, and understanding the operational dynamics of cybercriminal groups, as demonstrated by their comprehensive investigation into the GrassCall campaign.