Fake job applications pack malware that kills endpoint detection before stealing data
Russian-speaking attackers lure HR staff into downloading ISO files that disable defenses
A Russian-speaking cyber criminal is targeting corporate HR teams with fake CVs that quietly install malware which can disable security tools before stealing data from infected machines.
The operation, detailed in a threat report from networking and security outfit Aryaka, exploits one of the most mundane workflows within an organization: hiring.
Researchers say the bait arrives as what looks like a perfectly normal job application sitting on a well-known cloud storage service. To the recruiter skimming through a stack of candidates, it appears to be just another CV, but opening it quietly kicks off a series of background actions that knock out security tools and hand the attackers a foothold on the machine.
"An HR professional receives what appears to be a perfectly normal resume," said Aditya K Sood, VP of Security Engineering and AI Strategy at Aryaka. "The candidate profile seems relevant. The hosting link points to a familiar cloud storage service. Nothing feels suspicious. A quick download, a double click, and an ISO file mounts, and the intrusion begins."
The malicious document arrives as an ISO disk image, a file format Windows can mount like a virtual drive. Once opened, the archive contains a shortcut that quietly launches hidden commands in the background. Those commands unpack malware concealed inside an image file – a trick designed to make the payload harder for security tools to spot.
From there, the attack burrows deeper into the system. The malware connects to remote infrastructure controlled by the attackers and begins gathering details about the compromised machine before pulling down additional instructions. Much of the activity runs directly in memory, leaving fewer traces behind for defenders to discover later.
The campaign's most concerning feature is a component dubbed "BlackSanta," which the report describes as an EDR killer – software specifically designed to disable the very tools meant to detect intrusions.
BlackSanta leans on a tactic known as Bring Your Own Vulnerable Driver, loading legitimate but buggy kernel drivers to gain deeper control of the system. Once it has that level of access, the malware can start knocking down defenses – killing antivirus processes, disabling EDR agents, weakening Microsoft Defender, and even muting some logs that might otherwise tip off administrators that something is amiss.
In practical terms, the tool clears the security guards out of the building before the burglars start rifling through the filing cabinets.
Once defenses are disabled, the malware shifts to data collection, hunting for useful information on the infected device. According to the report, the attackers are particularly interested in sensitive files and cryptocurrency-related artifacts. Any valuable data it finds is quietly exfiltrated over encrypted connections.
The broader lesson is that recruitment pipelines have become a surprisingly effective entry point for attackers, according to Aryaka. Hiring teams regularly download files from strangers and work under pressure to process large volumes of applications, making them an attractive target compared with more tightly controlled IT environments.
For companies that treat HR inboxes as low-risk territory, this report shows that attackers are increasingly happy to start their break-ins where the guard is least likely to be watching.
"Organizations should treat HR workflows with the same defensive rigor as finance and IT administrative functions," concluded Sood. ®