How the Scam Works
The scam starts when cybercriminals, pretending to be legitimate job applicants, reach out to recruiters through job-hunting platforms. After initial contact, they send a follow-up phishing email that directs the recruiter to a convincing online portfolio site. These sites, often hosted on Amazon Web Services (AWS), mimic authentic job seeker pages, sometimes using plausible names associated with the applicant.
To evade automated security systems, the phishing emails do not contain clickable hyperlinks. Instead, recruiters are prompted to manually type the provided web address into their browser, which helps the attackers bypass link-detection tools[1].
The Malware: More_eggs
Once on the fake portfolio site, the recruiter is asked to complete a CAPTCHA and other checks to prove they are human, further evading automated scanners. If they proceed, they are offered a ZIP file to download—purportedly a resume or work sample. Inside the ZIP is a Windows shortcut (.LNK) file that, when opened, executes a hidden JavaScript payload using wscript.exe. This payload connects to the attackers' command-and-control server and installs the More_eggs backdoor.
More_eggs is a modular, JavaScript-based malware-as-a-service tool that allows attackers to:
- Remotely execute commands
- Steal credentials
- Deliver additional malicious payloads
Notably, More_eggs operates in the memory of the users device, making it harder for traditional antivirus solutions to detect.
Evasion Tactics
FIN6 leverages several techniques to avoid detection and takedown:
- Anonymous Domain Registration: Domains are registered through GoDaddy with privacy services, obscuring the true identity of the registrants[1].
- Cloud Hosting: Hosting malicious sites on AWS infrastructure provides legitimacy and resilience against quick takedowns[1].
- Human Verification: CAPTCHAs and environmental checks ensure only real users (not automated scanners) reach the malware download stage[1].
Industry Response
AWS responded to the incident by reaffirming its commitment to enforcing its terms of service and collaborating with the security research community. The company encourages reporting of any suspected abuse through its dedicated channels for swift action.
Takeaways for Recruiters and Organizations
This campaign highlights the evolving landscape of cyber threats, where even those in hiring roles are now prime targets. Key steps for recruiters and organizations to protect themselves include:
- Treat unsolicited portfolio links with suspicion, especially if they require manual entry into a browser.
- Avoid downloading ZIP files or clicking on shortcut files from unknown or untrusted sources.
- Ensure endpoint security solutions are updated and capable of detecting in-memory malware.
- Report suspicious activity to IT or security teams immediately.
Recruiters and organization should be aware of the attacks and use caution with job applicants.
References
