Summary Points
- A Vietnamese cybercrime group is using AI-generated malicious code to conduct a widespread phishing campaign distributing PureRAT malware via fake job offers.
- The malware campaign involves sophisticated social engineering with phishing emails and ZIP archives mimicking legitimate employment opportunities from well-known companies.
- Researchers identified AI-created scripts in the malware featuring detailed Vietnamese comments and emoji symbols, indicating advanced, automated programming techniques.
- The malware establishes persistence through hidden directories, DLL sideloading, and registry modifications, while disguising malicious activity with legitimate-looking files and documents.
Underlying Problem
In December 2025, a Vietnamese cybercrime group launched a sophisticated phishing campaign using artificial intelligence to create malicious code. They sent fake job emails from well-known companies, enticing recipients to open ZIP archives with misleading names like “Salary and Benefits Package.zip.” Once opened, these archives triggered malware installations, including PureRAT and HVNC tools, which granted attackers remote access to compromised systems.
This attack targeted various organizations worldwide, suggesting a focus on selling network access rather than specific espionage. Researchers from Symantec discovered that the malware scripts were visibly AI-generated, evident through Vietnamese comments, emojis, and detailed instructions within the code. The malware cleverly used legitimate-looking files to load malicious DLLs, establishing persistence by copying itself into hidden directories, modifying system registries, and deceiving users with seemingly normal documents. The Vietnamese origin is underscored by language, email domains, and usernames associated with the group. Symantec’s detection tools now protect systems against these evolving threats, highlighting a concerning leap in cyberattack tactics.
Risk Summary
Threat actors are increasingly using AI to craft fake job offers that look convincing and lure unsuspecting employees. Once applicants click on malicious links, attackers can deploy malware like PureRAT, which grants them full control over company systems. This can lead to data theft, financial loss, and operational disruption. In today’s digital landscape, any business—big or small—could fall victim. As a result, their reputation may suffer, sensitive information exposed, and recovery costs soar. Therefore, staying vigilant and protecting your hiring process from AI-driven scams is essential to avoid significant harm.
Fix & Mitigation
In the evolving landscape of cyber threats, the rapid identification and remediation of malicious activities are critical, especially when threat actors utilize sophisticated methods like AI-generated malicious job offers to deploy tools such as PureRAT. Prompt action not only prevents potential data breaches and system compromises but also preserves organizational integrity and stakeholder trust.
Detection Strategies
Implement advanced email filtering and anomaly detection systems to identify suspicious job offers. Regularly train staff to recognize signs of AI-generated content and phishing attempts.
Access Control
Enforce strict access controls and multi-factor authentication to limit the spread and impact of malware. Regularly review and update permissions, especially for recruiters and HR personnel.
Threat Intelligence
Leverage threat intelligence feeds to stay informed about emerging AI-based scams and PureRAT variants. Share threat data with security communities to enhance collective defense.
Incident Response
Develop and routinely test incident response plans specific to malware deployment via malicious job offers. Ensure rapid containment and eradication procedures are in place.
System Hardening
Update and patch all systems regularly to close vulnerabilities exploited by malware. Disable macros and automate security configurations to prevent execution of malicious scripts.
User Training
Conduct targeted awareness campaigns emphasizing the risks of AI-generated job offers and how to verify their legitimacy. Foster a culture of vigilance among employees and recruiters.
Monitoring & Analytics
Implement continuous monitoring and behavioral analytics to detect abnormal activities indicative of PureRAT infection or lateral movement within networks. Use automated alerts for quick response.
Vendor Management
Assess and monitor third-party recruiters and platforms for security practices. Ensure compliance with best cybersecurity standards to reduce the surface for malicious offers.
Advance Your Cyber Knowledge
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Access world-class cyber research and guidance from IEEE.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1cyberattack-v1-multisource
