A sophisticated, year-long campaign has been identified targeting HR departments and recruiters with a variety of malware designed to steal sensitive corporate data and employee information.

Attack Flow

The campaign, active since early 2025, typically follows a consistent multi-stage infection path:

• The Hook: Attackers send highly personalized emails to HR staff responding to open job postings. These emails often include a link to a cloud storage service (like Dropbox or Google Drive) supposedly containing a “portfolio” or “resume.”
• The Payload: The linked file is often a password-protected ZIP or a disguised executable (e.g., Resume_Project_Manager.exe.lnk). Once opened, it deploys malware such as More_eggs or WarmCookie.
• Persistent Access: The malware acts as a backdoor, allowing attackers to download additional tools, take screenshots, and harvest credentials stored in browsers.

Why Target HR?

HR professionals are high-value targets for several strategic reasons:

• Inherent Trust: Their job requires them to open attachments and links from unknown external sources (applicants).
• Sensitive Data Access: HR accounts often have access to Personally Identifiable Information (PII), payroll systems, and internal employee directories.
• Lateral Movement: Compromising an HR workstation provides a perfect jumping-off point to move laterally through the corporate network or conduct Business Email Compromise (BEC) scams.

Mitigation Steps

• File Sandboxing: Ensure all external attachments are opened in a secure sandbox environment before reaching the main network.
• EDR Monitoring: Deploy Endpoint Detection and Response (EDR) to flag suspicious script executions (like PowerShell or CMD) triggered by document files.
• Strict Web Filtering: Block access to unauthorized file-sharing sites that aren’t part of the official corporate workflow.