Fake job applications pack malware that kills EDR before stealing data

A Russian-speaking cybercriminal campaign targets HR teams by sending what appear to be legitimate CVs hosted on cloud storage; when opened the ISO mounts and a shortcut executes hidden commands that unpack malware hidden in an image. The payload, dubbed "BlackSanta," uses Bring Your Own Vulnerable Driver (BYOVD) techniques to obtain kernel-level access, disable antivirus/EDR and logging, then collect and exfiltrate sensitive files and cryptocurrency artifacts, highlighting recruitment workflows as an effective attack vector.