Loading story…
A Vietnamese cybercrime group known as BatShadow has launched a sophisticated phishing campaign targeting job seekers and digital marketing professionals. The campaign employs social engineering tactics, with attackers posing as recruiters and distributing malicious files disguised as job descriptions and corporate documents. Victims receive phishing emails containing ZIP archives that include decoy PDF documents and hidden malicious files, such as shortcut (LNK) or executable files masked as PDFs. When these files are opened, they trigger an infection chain that delivers a previously undocumented Go-based malware called Vampire Bot. The infection process involves the execution of embedded PowerShell scripts, which reach out to external servers to download additional payloads, including lure documents and remote desktop connection software like XtraViewer. The attackers use clever techniques to bypass browser security, instructing victims to use Microsoft Edge for downloads, as scripted pop-ups and redirects are more likely to be blocked in other browsers like Chrome. Once installed, Vampire Bot provides persistent access to compromised systems and is capable of continuous desktop surveillance. The malware captures screenshots at configurable intervals, compresses them into WEBP format, and exfiltrates them over encrypted channels, giving operators substantial visibility and control over victim machines. Vampire Bot also checks in with its command and control server for new commands and can download further payloads to expand its capabilities. The campaign demonstrates BatShadow's evolution from using commodity malware to deploying custom, advanced surveillance tools. The group is part of a growing number of cybercrime gangs operating out of Vietnam, with a history of targeting both domestic and foreign organizations. The use of job-themed lures and the focus on digital marketing professionals suggest a deliberate targeting strategy aimed at individuals likely to open unsolicited job offers. Security researchers have highlighted the persistent and stealthy nature of Vampire Bot, which is designed to evade detection and maintain long-term access to infected systems. The campaign underscores the ongoing threat posed by social engineering attacks and the need for heightened vigilance among job seekers and professionals receiving unsolicited emails. Organizations are advised to educate their users about the risks of opening unexpected attachments and to implement robust endpoint protection measures. The emergence of Vampire Bot also signals a trend toward more targeted and technically sophisticated malware campaigns in the cybercrime landscape.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Security reporting identified a BatShadow threat campaign using a new Go-based malware family dubbed 'Vampire Bot' to target people seeking jobs. Multiple outlets described the same operation as focused on luring and infecting job hunters.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly exploiting the job search process to launch sophisticated social engineering attacks aimed at stealing credentials and compromising systems. In one widespread campaign, attackers send phishing emails that masquerade as job offers for Social Media Manager positions, leveraging the reputations of well-known brands such as KFC, Ferrari, and Red Bull to build trust with potential victims. These emails are often sent from legitimate-looking services like Google Workspace and Microsoft 365, making them harder to detect. Victims who click on the provided links are redirected through a series of deceptive web pages, including fake security checks and fraudulent job postings designed to mimic reputable sites like Glassdoor. The process culminates in a fake Facebook login page, where users are tricked into entering their credentials, which are then harvested by the attackers. Sublime Security researchers have identified telltale signs of these scams, such as suspicious URLs that appear to be associated with trusted brands but are actually redirects to malicious sites. The attackers use templates or large language models to generate convincing, varied phishing messages at scale, increasing the reach and effectiveness of their campaign. In a separate but thematically similar attack, developers are targeted on LinkedIn by a fake recruiter claiming to represent an AI-driven company called DLMind. The recruiter, using a well-crafted persona and a polished LinkedIn profile, invites victims to access a private GitHub repository under the pretense of a coding assessment. When the victim runs the provided setup script, a multi-stage malware payload is executed. This malware is designed to scan for sensitive files, steal browser credentials and cookies, hijack clipboard data, collect system information, and establish persistent remote access using tools like AnyDesk. The attack chain is carefully engineered to blend into a developer’s normal workflow, making detection difficult. Both campaigns demonstrate a trend of attackers weaponizing trust and exploiting the job-seeking process, using a combination of social engineering and technical sophistication to achieve their objectives. The impact of these attacks includes the theft of social media credentials, exposure of sensitive personal and professional data, and the potential for long-term system compromise. Security researchers emphasize the importance of vigilance when responding to unsolicited job offers, especially those that require logging in through unfamiliar portals or running code from unverified sources. Organizations are advised to educate employees about these tactics and implement technical controls to detect and block such phishing and malware delivery attempts. The use of legitimate platforms and convincing personas by attackers underscores the need for robust verification processes and heightened awareness among job seekers and professionals alike. These incidents highlight the evolving nature of social engineering threats and the critical importance of multi-layered defense strategies. The campaigns also illustrate how attackers are leveraging automation and AI to scale their operations and increase the sophistication of their lures. As the job market remains competitive, individuals and organizations must remain alert to the risks posed by these targeted attacks. Ongoing monitoring, user education, and rapid incident response are essential to mitigating the impact of such credential theft and system compromise campaigns.
Jul 8, 2026
Hackers have launched a sophisticated phishing campaign that impersonates official notices from the National Police of Ukraine to target organizations running Microsoft Windows. The campaign begins with emails containing malicious Scalable Vector Graphics (SVG) files, which are exploited due to their text-based nature that allows embedding of harmful scripts. When recipients open the SVG attachment, they are presented with a deceptive loading screen, after which the system downloads password-protected ZIP archives such as ergosystem.zip or smtpB.zip. The password is provided in the email to increase the appearance of legitimacy. Inside these archives, a Compiled HTML Help (CHM) file acts as the main trigger, executing a malicious script known as CountLoader. This loader connects to a remote server, exfiltrates basic system information, and then delivers the final malware payloads directly into memory, making detection challenging. The two primary payloads identified are Amatera Stealer, which is designed to steal sensitive data, and PureMiner, a cryptominer that hijacks system resources for illicit cryptocurrency mining. PureMiner is delivered using DLL sideloading techniques from the ZIP archive, while Amatera Stealer is deployed through the same infection chain. Security researchers have highlighted the dual threat posed by this campaign: data theft and resource hijacking. The use of SVG files is particularly concerning because they can contain embedded JavaScript and HTML, and on Windows systems, they are often opened by Microsoft Edge, which may lack adequate security controls if not the user's primary browser. The attackers use formal legal language in the phishing emails to pressure recipients into compliance, increasing the likelihood of infection. The campaign is notable for its fileless approach, as the malware is loaded directly into memory rather than being written to disk. This method complicates detection and remediation efforts for security teams. The infection chain leverages social engineering, technical obfuscation, and multiple stages to maximize its effectiveness. Researchers have also observed creative obfuscation within the SVG files, such as disguising malicious code with food and recipe-related variable names. The campaign demonstrates a high level of technical sophistication and adaptability, exploiting both human and technical vulnerabilities. Organizations are advised to educate users about the risks of opening unexpected attachments, especially SVG files, and to implement robust endpoint protection capable of detecting fileless threats. The campaign underscores the ongoing evolution of phishing tactics and the need for continuous vigilance in email security. Security teams should review their email filtering and endpoint monitoring policies to address this emerging threat vector. The use of password-protected archives and legitimate-seeming legal notices increases the campaign's success rate, making it a significant concern for enterprises.
Jun 29, 2026
Threat actors have launched multiple campaigns distributing the ValleyRAT remote access trojan (RAT), targeting both organizations in China and job seekers. In one campaign, the group known as Silver Fox used search engine optimization (SEO) poisoning and fake Microsoft Teams installers to lure Chinese-speaking users, including those in Western companies operating in China, into downloading a trojanized setup file. The installer, disguised with Russian linguistic elements to mislead attribution, deploys ValleyRAT, which enables remote control, data exfiltration, and persistent access to infected systems. The malware loader checks for security software like 360 Total Security and manipulates Microsoft Defender exclusions to evade detection. A separate ValleyRAT campaign has been observed targeting job seekers via malicious emails that leverage a weaponized Foxit PDF Reader for DLL side-loading. This campaign uses social engineering to trick users into executing the malware, which then allows attackers to monitor activity, steal sensitive data, and potentially compromise HR professionals as well. Both campaigns demonstrate a high level of sophistication, utilizing layered obfuscation, dynamic execution techniques, and strategic targeting to maximize infection rates and evade security controls. Security vendors have updated detection and hunting capabilities to address these threats, emphasizing the need for vigilance among organizations and individuals alike.
Jun 29, 2026