A spear-phishing email campaign has been detected targeting recruiters using a JavaScript backdoor known as More_eggs. This indicates ongoing efforts to infiltrate the sector under the pretense of fake job applications.
"A sophisticated spear-phishing lure tricked a recruitment officer into downloading and executing a malicious file disguised as a resume, leading to a more_eggs backdoor infection," reported Trend Micro researchers Ryan Soliven, Maria Emreen Viray, and Fe Cureg in their analysis.
More_eggs, marketed as malware-as-a-service (MaaS), is a type of malicious software designed to steal credentials, including those for online banking, email accounts, and IT administrator accounts.
This malware is attributed to a threat actor known as the Golden Chickens group (also called Venom Spider), and it has been utilized by several other cybercriminal organizations like FIN6 (ITG08), Cobalt, and Evilnum.
Earlier this June, eSentire revealed details of a similar attack that exploited LinkedIn to distribute fake resumes hosted on an attacker-controlled website. These files are actually Windows shortcut (LNK) files that trigger the infection sequence when opened.
The latest findings from Trend Micro show a slight change from the previously observed pattern, as the threat actors sent a spear-phishing email to build trust and gain the target's confidence. This attack was noted in late August 2024, aimed at a talent search lead in the engineering sector.
"Shortly after, a recruitment officer downloaded a supposed resume, John Cboins.zip, from a URL using Google Chrome," the researchers explained. "It was not determined where this user obtained the URL. However, it was clear from both users' activities that they were searching for an inside sales engineer."
Fake Job Applications
The URL in question, johncboins[.]com, features a "Download CV" button designed to lure the victim into downloading a ZIP archive containing the LNK file. It is important to note that the attack chain described by eSentire also includes an identical site with a similar button that directly downloads the LNK file.
Double-clicking the LNK file executes obfuscated commands that launch a malicious DLL, which is responsible for deploying the More_eggs backdoor via a launcher.
More_eggs begins its operation by checking whether it is running with admin or user privileges, then executes a series of commands to gather reconnaissance information on the compromised host. It subsequently communicates with a command-and-control (C2) server to receive and execute additional malware payloads.
Trend Micro reported observing another variant of the campaign that incorporates PowerShell and Visual Basic Script (VBS) components as part of the infection process.
"Attributing these attacks is challenging due to the nature of MaaS, which allows for the outsourcing of various attack components and infrastructure," they stated. "This complicates efforts to identify specific threat actors, as multiple groups can utilize the same tools and infrastructure provided by services like those offered by Golden Chickens."
Nonetheless, it is suspected that the attack could have been orchestrated by FIN6, as indicated by the tactics, techniques, and procedures (TTPs) employed.
This development follows weeks after HarfangLab exposed PackXOR, a private packer used by the FIN7 cybercrime group to encrypt and obfuscate the AvNeutralizer tool.
The French cybersecurity firm noted that the same packer was observed being used to "protect unrelated payloads," such as the XMRig cryptocurrency miner and the r77 rootkit, suggesting it could also be utilized by other threat actors.
"PackXOR developers might indeed be connected to the FIN7 cluster, but the packer seems to be used for activities unrelated to FIN7," HarfangLab stated.
FIN7 actors have also been identified hosting a network of seven honeypot domains that lure users searching for AI-powered deepnude generators into downloading malware like Lumma Stealer, Redline Stealer, and D3F@ck Loader, which can steal sensitive data or facilitate follow-on campaigns deploying ransomware.
Cybersecurity firm Silent Push has also identified ongoing, parallel FIN7 campaigns delivering NetSupport RAT through websites prompting visitors to install a browser extension to access specific content. These sites impersonate legitimate brands such as SAP Concur, Microsoft, Thomson Reuters, and FINVIZ.
"FIN7 AI deepfake honeypots redirect unsuspecting users who click on the 'free download' offer to a new domain featuring a Dropbox link or another source hosting a malicious payload," they concluded. "It is likely FIN7 is using SEO tactics to improve the visibility of their honeypots in search results."
