Key points of this blogpost: DeceptiveDevelopment targets freelance software developers through spearphishing on job-hunting and freelancing sites, aiming to steal cryptocurrency wallets and login information from browsers and password managers. However, while Operation DreamJob targeted defense and aerospace engineers, DeceptiveDevelopment reaches out to freelance software developers, often those involved in cryptocurrency projects. VictimologyThe primary targets of this DeceptiveDevelopment campaign are software developers, mainly those involved in cryptocurrency and decentralized finance projects. In addition to the connections between the GitHub profiles, the malware used in DeceptiveDevelopment is rather simple. BeaverTailBeaverTail is the name for the infostealer and downloader malware used by DeceptiveDevelopment.