The cybercriminal group FIN6, also known as Skeleton Spider, has adopted a new tactic by posing as job seekers on platforms like LinkedIn and Indeed to distribute malware through fake resumes. This marks a shift from their traditional focus on stealing payment card data from point-of-sale (POS) systems in the hospitality and retail sectors. In their latest campaign, FIN6 engages with recruiters, builds rapport, and then sends phishing emails that lead to the deployment of the MoreEggs backdoor malware. The phishing emails are crafted to bypass security filters by requiring recipients to manually type URLs into their browsers, which direct them to landing pages mimicking personal resume portfolios. These pages, hosted on trusted cloud infrastructure such as AWS, use traffic filtering and CAPTCHA to ensure only human recruiters are targeted. Once verified, the site delivers a malicious ZIP file containing the MoreEggs malware, which is sold as malware-as-a-service by another group known as Venom Spider. MoreEggs facilitates credential theft, system access, and subsequent ransomware attacks. FIN6’s use of AWS infrastructure and GoDaddy’s domain privacy services adds layers of obfuscation, making it difficult for investigators to trace and dismantle their operations. The group has been operational since at least 2012 and has previously used Magecart JavaScript skimmers to target e-commerce sites. The campaign highlights the effectiveness of low-complexity phishing attacks when combined with advanced evasion techniques and reputable cloud services. AWS has stated its commitment to disabling prohibited content and encourages the security community to report any suspected abuse.