Loading story…
Security firms reported multiple spearphishing campaigns that used LinkedIn job applications, fake job offers, and poisoned resumes to deliver the More_eggs malware to recruiters, hiring managers, and other business professionals. In observed intrusions, victims were directed through legitimate-looking resume workflows that ended with a malicious archive or shortcut file, often disguised as a document, which launched obfuscated activity and installed the JavaScript-based backdoor. The campaigns were seen across sectors including industrial services, aerospace and defense, legal, accounting, staffing, and healthcare technology, showing a sustained focus on personnel involved in recruiting and hiring.
The malware and delivery chain were linked to Golden Chickens (also known as Venom Spider) and associated tooling such as VenomLNK, TerraLoader, and TerraPreter, though the specific operators behind individual incidents were not always confirmed. The attacks abused signed Windows binaries including regsvr32, wmic, msxsl.exe, ie4uinit.exe, and in earlier cases cmstp to evade detection, establish execution, perform discovery, and communicate with command-and-control infrastructure. Defenders said More_eggs can support credential theft, data exfiltration, lateral movement, remote access, and follow-on ransomware activity, and in at least one case endpoint telemetry caught suspicious XSL script processing and related malicious behavior before the intrusion succeeded.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
eSentire disclosed an unsuccessful phishing attack in May 2024 against an unnamed industrial services company, where a recruiter was lured by a fake applicant and resume download site. The malicious LNK retrieved a DLL via ie4uinit.exe, executed it with regsvr32.exe, established persistence, performed host discovery, and dropped the JavaScript-based More_eggs backdoor.
eSentire reported observing Golden Chickens campaigns using fake job offers and fake resumes between April 2021 and April 2022. The activity delivered the more_eggs malware suite through recruitment-themed lures targeting corporate employees and hiring managers.
Trend Micro reported that skimming activity began on Volusion's e-commerce cloud platform on September 7, 2019, after attackers injected malicious code into a Volusion JavaScript library used on checkout pages. The compromise affected 3,126 online shops and was attributed to Magecart Group 6, also known as FIN6.
eSentire said a February 2019 campaign targeted U.S. retail, entertainment, and pharmaceutical companies with fake job offers delivering the more_eggs malware. The report cited this as earlier precedent for later LinkedIn and resume-themed activity.
Proofpoint said it had tracked a series of fake job campaigns since mid-2018 that used LinkedIn outreach, follow-up emails, spoofed staffing-company sites, and malicious documents or loaders to deliver the More_eggs backdoor to primarily U.S. companies. The campaigns targeted sectors including retail, entertainment, pharmacy, and other businesses involved in online payments.
Expel observed a recruiter click a legitimate-looking LinkedIn resume workflow that led to a fake PDF error page, a ZIP masquerading as a .docx file, and a malicious LNK. The intrusion abused regsvr32, wmic, ie4uinit.exe, and msxsl.exe, triggered multiple Microsoft Defender for Endpoint alerts, and led to attempted command-and-control and data exfiltration before containment.
eSentire disclosed a campaign targeting hiring managers at four organizations: a U.S. aerospace/defense company, a large UK CPA firm, a Canada-based international business law firm, and a Canadian staffing agency. The campaign used fake resumes with a benign PDF decoy and a variant that abused ie4uinit.exe and msxsl.exe.
eSentire said three of four related more_eggs incidents in a renewed poisoned-resume campaign occurred at the end of March. The activity involved attackers posing as job applicants and sending fake resumes to hiring managers.
eSentire reported a spearphishing incident in which a healthcare-technology professional was targeted on LinkedIn with a fake job offer tailored to the victim's job title. The infection chain used VenomLNK, TerraLoader, TerraPreter, and abused WMI, cmstp, regsvr32, and msxsl before eSentire disrupted the attack.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 90 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
14 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcesecurityintelligence.com
Open sourceexpel.com
Open sourceesentire.com
Open sourceblog.talosintelligence.com
Open sourceattack.mitre.org
Open sourcewelivesecurity.com
Open sourceusa.visa.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Securonix Threat Labs reported that the **OCX#HARVESTER** campaign used phishing emails carrying ZIP archives with disguised `.lnk` files to compromise victims, with activity observed primarily between late 2022 and early 2023. The operation appears tied to the **More_eggs/Golden Chickens** malware ecosystem and likely focused on organizations and individuals linked to the financial sector, particularly cryptocurrency-related entities. After execution, the infection chain launched obfuscated JavaScript loaders and abused multiple Windows living-off-the-land binaries, including `ie4uinit.exe`, `msxsl.exe`, `wmic.exe`, `regsvr32.exe`, `curl.exe`, and `typeperf.exe`, to stage payloads, establish persistence, and communicate with command-and-control infrastructure. Later stages deployed several **OCX#HARVESTER** binaries, including a screenshot-capture component, additional obfuscated implants, and what researchers assessed was likely a **Cobalt Strike** beacon. Operators also retrieved **SharpChrome** to steal Chrome cookies and credentials, expanding the campaign from initial access to credential theft and post-compromise surveillance. The use of `msxsl.exe`, a known LOLBin documented by the LOLBAS project, underscores the campaign's reliance on legitimate Microsoft-signed utilities to blend malicious activity into normal system operations, while shifting command-and-control infrastructure suggests the toolkit remains actively maintained and adapted to evade detection.
Aug 14, 2026
Attackers ran **Operation In(ter)ception**, a targeted espionage campaign against aerospace and military organizations in Europe and the Middle East by posing as recruiters on LinkedIn and impersonating **Collins Aerospace** and **General Dynamics**. Victims were lured into opening password-protected RAR archives that contained malicious `.LNK` files, which created persistence through scheduled tasks and used **WMIC** to launch remote XSL scripts. The intrusion chain deployed a custom multistage toolset, including a Stage 1 downloader and a modular Stage 2 backdoor, while also abusing modified open-source utilities such as **PowerShdll** and **dbxcli**.
Aug 14, 2026
Aryaka researchers reported a **Russian-speaking** threat actor targeting corporate **HR teams and recruiters** with fake job applications that deliver malware via a resume-themed **ISO** file, likely distributed through spam and hosted on common cloud storage services. When the ISO is mounted, victims are tricked into executing a disguised **Windows shortcut (`.lnk`)** that launches `cmd`/PowerShell, extracts hidden data from an image file, and runs additional PowerShell in memory. The chain then downloads a decoy archive (e.g., `SumatraPDF.zip`) from attacker-controlled domains (including `resumebuilders.us` and `thresumebuilder.com`), leveraging **DLL sideloading** (e.g., `SumatraPDF.exe` loading `DWrite.dll`) to execute the next-stage payload while blending into normal user activity. A key capability in the operation is an **EDR/AV “killer”** component (described as **BlackSanta**) intended to disable endpoint defenses before follow-on actions such as host profiling and data theft, with much of the activity occurring **in memory** to reduce forensic artifacts. Aryaka assessed the campaign as **low-noise and potentially long-running (over a year)**, but noted limited telemetry on overall prevalence; the tradecraft is designed to exploit routine hiring workflows where recruiters rapidly open candidate materials and may not scrutinize ISO-mounted content or shortcut execution.
Jun 29, 2026