Wallet Drained After Job Interview

I've been in crypto since 2018 and never thought I'd fall for something like this.

I was contacted for what appeared to be a legitimate remote job. The scammers created an entire hiring process with multiple emails, a professional-looking website, and an interview platform. The "company" is called The Trading Field on linkedin and the job position "Crypto Ecosystem Specialist".

The interview was scheduled on a strange platform called prysmo.app, which got me suspicious but looked clean enough for me to go through with it. When the interview started, I got an error saying that my microphone couldn't be found and to download their Desktop app. There was a prerecorded woman on video saying she couldn't hear me and instructing me to install their interview application. Under the pressure of trying to fix the interview, I downloaded and ran the installer, only after running the installer and seeing a CLI for 2 seconds, I realised what I've done. I've immediatelly done a complete reinstall of Windows from a clean bootable USB drive.

However, a few hours later, my MetaMask wallet was completely drained.

Looking back, I believe my biggest mistake was keeping my MetaMask Secret Recovery Phrase in a plain .txt file on my PC (idiot move I know, but I was able to ward off the malwares for the past 8 years and didnt see chances of anyone infecting my PC. My PC was actually turned off when the funds were stolen, which makes sense if they had already obtained the recovery phrase.

Thankfully, my main holdings are on a different hardware wallet so those were not affected. The loss was my hot wallet, around $1,600, but that's still a significant amount for me and my family.

Please learn from my mistakes and keep your crypto in cold storage. I also never thought it would happen to me, and after 8 years, all it took was a second of not thinking straight. These scams are becoming more elaborate by the day and they socially engineer you as much as possible, slowly taking their time with HR processes and not rushing so you think they're for real.

I think them saying that the company is founded in 2018 but me not being able to find a single entry about them online should've been obvious in hindsight. Their website is thetradingfield.com in case anyone cares. I will be reporting them on linkedin so it doesn't happen to more people.