Malware - Fake Job Offers Spread via Google Forms

What Happened

A new malware campaign has emerged, cleverly using Google Forms to distribute PureHVNC, a type of Remote Access Trojan (RAT). Attackers are leveraging business-related lures, such as job interviews and project briefs, to trick victims into downloading malicious files. Instead of the usual phishing emails, these attackers are embedding links in seemingly legitimate Google Forms.

Once a victim clicks on a link to download a ZIP file, they unknowingly initiate a multi-stage infection process. This method is particularly alarming because it exploits the trust users place in familiar platforms like Google Forms, making it easier for attackers to bypass security measures.

Who's Being Targeted

The campaign primarily targets individuals seeking job opportunities or involved in business processes. The attackers impersonate real companies, using their names and logos to create convincing forms. This tactic not only enhances the credibility of the scam but also increases the likelihood that victims will engage with the malicious content.

Platforms like LinkedIn are often used to disseminate these links, further targeting professionals who may be more susceptible to such scams. The forms typically request professional information, making them appear legitimate and increasing the chances of successful infection.

Signs of Infection

Once the malicious ZIP file is downloaded, it usually contains both legitimate files and an executable file that triggers the infection. The executable is often bundled with a DLL file, which is executed through a technique known as DLL hijacking. This allows the malware to run while appearing to be part of a legitimate process.

The PureHVNC malware can take full control of the infected device, allowing attackers to steal sensitive information, including data from browsers and cryptocurrency wallets. Users may not immediately notice signs of infection, as the malware operates stealthily, gathering information and maintaining persistence on the device.

How to Protect Yourself

To stay safe from this evolving threat, it is crucial to remain vigilant when interacting with Google Forms. Here are some essential tips:

• Always verify the source of any Google Form before providing personal information or downloading files.
• Be cautious of links that redirect through URL shorteners, as they may hide the true destination.
• If you receive a job offer or business-related request, confirm it through official channels before taking action.

By being aware of these tactics and maintaining a cautious approach, you can significantly reduce the risk of falling victim to this malware campaign.