A fake crypto job offer led to an $11.8 million loss after malware gave attackers access to a company’s systems and transaction controls.