A new cyber-espionage campaign targets HR staff with fake job applications that secretly install malware capable of disabling security software and stealing sensitive data.
Researchers at Aryaka Threat Labs say the operation appears to be run by a Russian-speaking threat actor and has likely been active for more than a year, largely unnoticed.
The attackers lure recruitment teams with what look like legitimate CVs hosted on popular cloud storage services. However, opening the files quietly launches a chain of hidden commands that undermine system defences and allow the intruders to gain control of the computer.
"This campaign has remained largely unnoticed for over a year, demonstrating the threat actor's capability to conduct targeted, persistent operations," the researchers said in their report.
The malware is delivered through spear-phishing emails containing links that direct recipients to download ISO files hosted on cloud storage platforms such as Dropbox.
Once opened, the archive contains what appears to be a simple shortcut file. In reality, the shortcut runs commands in the background that unpack malware concealed within an image file, a tactic designed to avoid detection by security software.
The malware then contacts attacker-controlled servers, gathers information the infected machine and downloads additional instructions.
Much of the activity runs directly in the system's memory, leaving few traces for investigators.
This layered approach helps the attackers remain stealthy while maintaining long-term access to compromised systems.
One of the most significant elements of the campaign is a component known as BlackSanta, described as an "EDR killer".
Endpoint detection and response (EDR) tools are designed to detect suspicious behaviour on computers and alert security teams to potential intrusions, and BlackSanta is built specifically to disable those protections.
The component does so using a technique known as "Bring Your Own Vulnerable Driver", in which legitimate but flawed system drivers are loaded to gain deep control of the operating system.
Once running at that level, the malware can terminate antivirus programmes, disable EDR agents, weaken protections in Microsoft Defender and suppress certain security logs.
In practical terms, researchers say, it removes the system's digital guards before the attackers begin searching for valuable information.
After neutralising security controls, the malware scans the infected system for useful data. The attackers seem particularly interested in sensitive documents and cryptocurrency-related information.
Any data it finds is exfiltrated over encrypted HTTPS connections to the attackers' command-and-control servers. The malware decrypts operational data only at runtime, making it harder for analysts to detect or analyse the threat through traditional methods.
The findings highlight how recruitment processes have become an appealing entry point for cybercriminals.
HR teams regularly download files from unknown applicants and often process large volumes of applications under time pressure. That routine behaviour makes them a softer target than more tightly monitored IT environments.
Last year, a sophisticated phishing campaign was uncovered that exploited to target senior finance executives with fake invitations to join the executive board of a fabricated investment fund.
The attackers used 's direct messaging feature to approach high-level professionals and entice them into clicking malicious links disguised as legitimate business opportunities.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
