This fake job offer scam will just infect your device with deadly malware

Conceptual art of a computer system being hacked.
(Image credit: Getty Images)

Cybersecurity researchers have spotted yet another fake job campaign distributing deadly malware. 

Mandiant's latest report found that a new version of known malware threat Ursnif (also known as Gozi) has been reported in the wild.

Unlike the previous versions, this one does not carry its usual banking trojan functionalities, prompting researchers to speculate the malware is being modded to distribute ransomware.

Fake job offers on LinkedIn

Mandiant dubbed this version LDR4, after spotting it in late June 2022. To distribute the malware, the threat actors are creating fake LinkedIn accounts, posing to be recruiters for major companies. After reaching out to their targets and engaging in a conversation to establish some legitimacy, they share a link.

The linked website then demands victims solve a CAPTCHA challenge to download an Excel document that claims to offer more details about the position, but actually carries a malicious macro that fetches the malware from a remote location. 

As LDR4 comes in the form of a .DLL file (loader.dll), is packed by portable executable crypters, and is signed with valid certificates, it evades detection from some antivirus solutions, the researchers warned. 

Once the .DLL file runs, it collects system service data from the Windows registry and generates a user and system ID. It also connects to the malware's command and control server (C2) to obtain the list of commands it needs to execute. 

Currently, the researchers can't 100% confirm Ursnif’s endgame, but they did note that a threat actor was allegedly observed asking for partners to distribute ransomware and the RM3 version of Ursnif via underground hacking forums. 

The last time we heard of Ursnif was in January 2022, when HP Wolf Security observed it being distributed, via weaponized Excel files, among Italian-speaking users. 

Via: BleepingComputer

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.