According to CoinMeta, as disclosed by SlowMist, a recent recruitment poisoning attack targeting job seekers for web3 occurred. The attackers impersonated web3 company and requested candidates to deploy and run a project named royalcity locally under the pretext of a remote interview. After running or building this project, the attackers were able to steal browser credentials, wallet extension data, and local files, monitor the clipboard, and achieve remote control. SlowMist stated that this project also implanted a server-side backdoor in errorhandler and js, allowing them to download and execute remote code. The attack method is highly similar to previous recruitment poisoning incidents involving GitHub.