Cybercriminals: The New Job Applicants

It seems cybercriminals have found a fresh avenue for their schemes—masquerading as hopeful job applicants. In recent tactics, hackers are sending resumes that are anything but genuine, preying on the trust of recruiters and hiring managers. This trend is a cunning move, particularly by a group called Skeleton Spider, or FIN6, who have exploited our natural assumption that professional profiles are legitimate.

According to DomainTools, this scheme isn’t random. These cyber adversaries build trust via platforms such as LinkedIn and Indeed, striking when least expected. What makes their approach even more sly is their use of platforms like AWS to quietly host malicious tools, making them harder to detect. Once the recruiter is hooked through a seemingly innocent email or professional connection, the real danger begins in subsequent interactions.

Through crafted communications, these criminals guide recruiters to fraudulent personal websites. The sites, often hosted on trusted services, appear credible at first glance but hide a malicious intent designed to evade detection by security filters. By presenting themselves as job seekers, they dodge typical red flags and gain trust.

Securing Recruiters from Cyber Threats

Once trust is earned, and certain conditions met, these sites prompt downloads of seemingly harmless files. Unbeknownst to victims, these may carry dangerous malware. Researchers found FIN6 distributing malware via Windows shortcut files packed with hidden JavaScript, which download more vicious software called “More_eggs.” This allows hackers to slip right past defenses, stealing data and accessing systems undetected.

The attack vector cleverly uses fake resumes on personal domains that seem credible by name but hide a nefarious agenda. These pages scrutinize visitors, allowing only targeted individuals to access malicious content, while anyone else sees plain text or undergoes CAPTCHA verification.

Experts urge caution: do not download ZIP files without approval from IT and beware of resumes from unknown sources. Mitigating such risks isn’t just about vigilance—it’s about policy, too. Network pros should restrict the execution of .LNK files, watch for unusual traffic, and prevent misuse of scripting engines—a proactive approach that can keep these threats at bay.

Don’t get caught in the cyber web. Stay informed and keep your systems safe. For more insights and resources, visit Qsentinel, your guide in a secure digital world.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.