LinkedIn Resume Phishing Delivered More_eggs Malware to Recruiters and Hiring Staff

Security firms reported multiple spearphishing campaigns that used LinkedIn job applications, fake job offers, and poisoned resumes to deliver the More_eggs malware to recruiters, hiring managers, and other business professionals. In observed intrusions, victims were directed through legitimate-looking resume workflows that ended with a malicious archive or shortcut file, often disguised as a document, which launched obfuscated activity and installed the JavaScript-based backdoor. The campaigns were seen across sectors including industrial services, aerospace and defense, legal, accounting, staffing, and healthcare technology, showing a sustained focus on personnel involved in recruiting and hiring.

The malware and delivery chain were linked to Golden Chickens (also known as Venom Spider) and associated tooling such as VenomLNK, TerraLoader, and TerraPreter, though the specific operators behind individual incidents were not always confirmed. The attacks abused signed Windows binaries including regsvr32, wmic, msxsl.exe, ie4uinit.exe, and in earlier cases cmstp to evade detection, establish execution, perform discovery, and communicate with command-and-control infrastructure. Defenders said More_eggs can support credential theft, data exfiltration, lateral movement, remote access, and follow-on ransomware activity, and in at least one case endpoint telemetry caught suspicious XSL script processing and related malicious behavior before the intrusion succeeded.