Cybercriminals Exploit Hiring Processes to Deliver Sophisticated Malware Payloads
A newly uncovered cyber threat campaign is exploiting a rarely defended yet essential business function: the hiring process. Security analysts have traced a stealthy wave of attacks targeting corporate HR departments, where job application workflows are being used as entry points for advanced malware deployment.
Behind the operation is the financially driven hacking group known as Venom Spider, which has shifted its tactics to align with a universally trusted business routine—opening resumes from job candidates. Posing as legitimate applicants, these attackers craft spear-phishing emails designed to lure hiring professionals into downloading what seem like resumes but instead activate a malicious payload.
At the center of this campaign is More_eggs, a stealthy backdoor tool engineered to perform wide-ranging cyber-espionage and data theft. Once embedded, it enables attackers to harvest credentials, exfiltrate financial records, and pilfer trade secrets—posing a major threat to enterprise confidentiality and integrity.
This strategic pivot marks a notable expansion for Venom Spider, historically known for targeting industries heavily reliant on e-commerce and payment systems, such as retail, streaming, and pharmaceuticals. By setting their sights on HR departments—a function shared by virtually every organization—they’ve broadened their attack surface dramatically.
According to cybersecurity firm Arctic Wolf, the malware has evolved with precision. New enhancements in its architecture are tailored to bypass automated defenses. For example, the delivery process now includes CAPTCHA challenges—cleverly mimicking real application portals while dodging basic email filters and sandbox detection tools.
How the Attack Works: From Innocent Resume to System Breach
The infection begins with a simple click. When a recruiter opens the fake resume link, they’re taken to a lookalike website containing a CAPTCHA prompt. After solving it, a ZIP file downloads, containing a malicious Windows shortcut (.lnk) and a harmless-looking image file for distraction.
Each malicious file is uniquely crafted using server-side polymorphism, altering its structure and obfuscation techniques for every download—making traditional signature-based detection nearly useless.
Once executed, the .lnk file triggers a deeply obfuscated command-line script that writes configuration data to a temporary file and quietly launches Windows WordPad to distract the victim. Behind the scenes, it invokes the legitimate system utility ie4uinit.exe, which begins executing attacker-controlled commands.
This leads to the creation of a dynamic dropper DLL at:
css
C:\Users\%username%\AppData\Roaming\Adobe\d{5}.dll
The dropper then generates encrypted JavaScript payloads, which can only be decrypted on the victim’s machine using system-specific attributes such as processor ID and device name—an evasive move that thwarts reverse engineering and sandbox analysis.
Each execution generates a new encryption key, combining hardcoded elements with brute-forced bytes—introducing time delays that further inhibit automated detection systems.
Once activated, More_eggs begins harvesting a rich set of system data: username, OS version, antivirus presence, IP address, install date, and more. This intelligence is exfiltrated to attacker-controlled servers, enabling follow-up attacks or more tailored exploitation.
Why HR Is the New Weak Link
HR personnel—by necessity—regularly open files from unknown sources. This daily responsibility has become a major liability, now recognized by threat actors as a blind spot in organizational security frameworks.
With malware now designed to exploit this very routine, the line between safe operational practice and successful cyber intrusion has become dangerously thin.
