To protect against such threats, security experts recommend implementing email security solutions, avoiding opening attachments from unknown senders, and deploying endpoint detection and response tools capable of identifying suspicious PowerShell commands and activities in startup locations. A sophisticated malware campaign dubbed "DocSwap" has emerged targeting Android users globally by disguising itself as a legitimate document security and viewing application. The attackers send phishing emails disguised as job opportunities from legitimate industrial organizations, attaching malicious files that appear to be employment offers but actually deploy malware to steal sensitive information. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. A sophisticated cyber espionage campaign has been uncovered where threat actors are masquerading as recruiters to target job seekers and employees of specific organizations. BI.Zone Security researchers identified this campaign in December 2024, attributing it to a threat actor known as Squid Werewolf (also tracked as APT37 or Reaper Group). With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The campaign uses social engineering tactics centered around job recruitment, a particularly effective strategy as job seekers are more likely to open attachments related to potential employment opportunities. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Once executed, the malware copies the legitimate Windows utility dfsvc.exe to the startup folder, ensuring it runs automatically when the system boots. The malware employs multiple evasion techniques, including time-based sandbox detection and internet connectivity checks. Their analysis revealed the attack had been carefully designed to evade detection while establishing persistent access to victims’ systems.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 18 Mar 2025 15:45:27 +0000