Ukrainian CERT says Sandworm-linked actors (UAC-0145) posed as recruiters to lure IT workers into a fake hiring process. Victims were guided from job-site chats to Telegram and Zoom, then emailed “VPN assessment” files that pushed a trojanized WireGuard-based VPN client capable of silently running commands on the victim’s computer.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re in a Zoom interview, recruiter says, “To start the technical test, connect to our corporate VPN.” Sounds legit, right? CERT Ukraine saw fake recruiters for Sopra Steria Bulgaria push IT admins from job sites to Telegram, then Zoom, then email you WireGuard VPN configs as a ‘technical assessment.’ When they ‘fail,’ you’re told to install a special client called SopraVPN. Here’s the catch: SopraVPN comes from a fake domain, soprasteria-bg[.]com, and a SourceForge project. It’s a trojanized WireGuard client that can silently run PowerShell commands and scheduled tasks on your machine while you think you’re just doing an interview. If any recruiter asks you to install a VPN or ‘assessment tool’ like SopraVPN, stop and verify through the company’s official website or HR contacts, before you install anything.
Researchers described two active social-engineering-driven malware campaigns: one uses trojanized “popular” remote-user apps (e.g., Zoom/WebEx lookalikes) to trick people into installing credential and crypto-stealing malware, and another uses hundreds of imposter GitHub repositories to lure…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
CERT-UA reports a Sandworm-linked group (UAC-0145) is using fake CAPTCHA checks on compromised websites to persuade Ukrainian visitors to run PowerShell commands that infect their own computers. The campaign also includes Android attacks where victims are sent trojan APK “security tools” via…
Cisco Talos reports a real campaign by a Russian-speaking group (UAT-11795) targeting users in the U.S. and Europe with trojanized installers for popular tools like Zoom, Webex, and MobaXterm. Victims are socially engineered via a “ClickFix” style trick into running a command that silently…
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
