A fake Web3 recruiter compromised a cryptocurrency employee through a Google Apps Script assessment that delivered a signed ClickOnce package, two credential stealers, and a persistent Go RAT with hVNC. Exact overlap in an SSL.com signing certificate and a Go-loader SHA-256 links the chain to contemporaneous activity described publicly as DPRK-nexus cryptocurrency targeting, while broader infrastructure resembles a traffer and malware-as-a-service ecosystem that has adopted DPRK-associated lures. The evidence does not resolve whether the operator was DPRK-linked or a criminal customer of shared delivery services. The intrusion exposed wallet keys, browser sessions, cloud and developer credentials, and resulted in a six-chain wallet drain followed by consolidation of about 22.6 ETH.