A new threat group going by the name “ResumeLooters” has used a series of SQL injections and cross-site scripting (XSS) attacks targeting dozens of jobs listing sites, retail sites, and even real estate websites to extract personal data from millions of people. Primarily targeting Asia and Australia, the threat actors exfiltrated individuals’ names, emails, phone numbers, and other personal information. ResumeLooters used a variety of tools including SQLmap and Acunetix, both of which are used to detect and exploit SQL injection flaws automatically. After using these common tools to identify their targets, the threat actor injected scripts into the website’s HTML. It has been noted that occasionally the injection of the HTML scripts is done improperly and poorly, even to the point of showing up on the website itself and making it obvious that there has been an attempted attack. However, when the injection is done correctly, the new HTML code will display a phishing form that steals user information. ResumeLooters has also been seen using some more novel techniques, such as posting fake resumes to the job boards that contain the XSS scripts themselves. The combination of poorly implemented attacks and the inability to cover their tracks effectively gives the impression of a new group that is conducting low hanging fruit attacks for financial gain, which is reinforced by the fact that the data stolen has been sold by two (2) Chinese-speaking Telegram accounts. CTIX analysts will continue to monitor the evolution of ResumeLooters and their abilities.