Fake Job Offers Deliver Fileless Malware Through Two Advanced Attack Chains

Cybercriminals are disguising sophisticated malware campaigns as routine recruiting outreach, using fake job descriptions and interview documents to compromise Windows computers with a single click.

New research from Cyderes’ Howler Cell threat intelligence team details two separate nine-stage attack chains that exploit the trust surrounding online recruitment. Although the campaigns appear to involve different operators, both use fileless malware, hidden persistence and security-tool bypasses to evade detection.

Fake job description installs PureRAT

The first campaign begins with a ZIP file named “Apex Job Description.” Inside is a legitimate Microsoft Word executable renamed to resemble a document. Opening it triggers DLL side-loading, allowing a malicious library to run through the trusted Microsoft binary.

The malware displays a decoy job description while secretly removing Windows’ mark-of-the-web protections, installing a portable Python environment and creating hidden staging folders.

Researchers connected the campaign with high confidence to a financially motivated Vietnam-linked cluster previously associated with PXA Stealer. The evidence includes reused command-and-control infrastructure, matching loader files and a nearly identical encoding process.

The final payload is PureRAT, a commercially available remote access trojan capable of stealing browser credentials, monitoring clipboards, capturing keystrokes and collecting cryptocurrency wallet information.

Removing the infection is unusually difficult. The malware creates scheduled tasks, a Windows Management Instrumentation event subscription and a COM hijack. It also maintains two mirrored staging directories capable of rebuilding one another if defenders delete only part of the operation.

Second campaign deploys custom Windows implant

The unrelated second campaign hides a Windows shortcut behind a fake PDF icon inside a job-interview archive. Clicking it launches Microsoft’s mshta utility, downloads an encrypted payload and runs a loader disguised as Lenovo software.

That loader decrypts and maps a custom DLL directly into memory. It checks system memory, disk capacity, display resolution and uptime to determine whether it is running inside a security sandbox. Computers that pass those tests receive a persistent cryptographic identity and connect to an attacker-controlled platform.

Cyderes did not attribute the second operation to a known threat group. Its custom malware can execute commands, steal clipboard content, record keystrokes, capture screenshots and audio, browse files and deploy additional payloads.

Fileless malware challenges traditional defenses

Both campaigns disable or bypass Windows Antimalware Scan Interface and Event Tracing for Windows telemetry before loading their final payloads. They also create scheduled tasks through Windows’ COM interface, avoiding the schtasks.exe activity many security products monitor.

The findings show why fake recruiter messages remain effective cyberattack tools. Job seekers routinely expect unfamiliar contacts, attachments and pre-interview documents, giving attackers a believable route past their targets’ initial suspicion.

Organizations should hunt for behavioral warning signs, including suspicious DLL side-loading, scheduled tasks created without schtasks.exe, unauthorized AMSI modifications and executable files masquerading as recruitment documents.