Researchers at Trend Micro have recently reported on a malware campaign targeting HR professionals with the “more_eggs” malware. More_eggs is a backdoor sold as Malware-as-a-Service (Maas) attributed to the Golden Chickens (aka Venom Spider) threat group. More_eggs is capable of stealing credentials, delivering additional payloads, and establishing command-and-control (C2) with the attacker. Researchers at eSentire also reported on a similar campaign in June 2024 that delivered more_eggs malware to recruiters via fake job applications. Given more_eggs is available for purchase by cybercriminals, multiple different groups could be behind these recent campaigns. The attack reported by Trend Micro begins with a spear-phishing email to a recruiter from a fake job-seeker purportedly interested in an inside sales engineer role. This led the recruiter to click on a URL named after the bogus candidate, which opened a professional-looking personal website with another link to “Download CV”. The download includes a LNK file and a jpeg file. The LNK file contains obfuscated commands which in turn execute a malicious DLL that drops the more_eggs malware onto the victim device. Submissions of similar LNK files to VirusTotal suggests that this is an ongoing campaign with two variations. The first variation includes LNK files typically named after a screenshot or document, uses string substitution for obfuscation, and includes additional PowerShell or Visual Basic scripts in the attack chain. The second variation includes LNK files typically named after a person, utilizes variable substitution for obfuscation, and does not use additional scripts in the infection chain. CTIX analysts recommend that recruiters use caution when downloading files from personal websites and consider compressed files or files with unexpected extensions to be particularly suspicious. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.