Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims

Arctic Wolf Labs reports that the financially motivated threat group Venom Spider (TA4557) is conducting a spear-phishing campaign against HR and recruitment staff by submitting malicious “resumes” that deliver a polymorphic JavaScript-based loader (More_eggs_Dropper) which ultimately deploys the More_eggs backdoor. The report includes a technical breakdown of the infection chain (LNK -> bat -> ie4uinit.inf -> obfuscated JS -> DLL dropper), C2 indicators, file and network IOCs, YARA rules, MITRE ATT&CK mappings, and recommended mitigations such as user training, EDR, and blocking identified infrastructure.