Google Forms Job Scam Spreads PureHVNC Malware

This report documents an active campaign abusing trusted platforms (Google Forms, LinkedIn, legitimate file hosts) to distribute PureHVNC, a modular .NET RAT that uses DLL hijacking, Python-based payloads and shellcode to achieve persistence (Run\Miroupdate, scheduled tasks), inject into legitimate processes, and exfiltrate browser data, wallets and messaging apps; the report includes technical indicators (C2 207.148.66.14, mutex "Rluukgz", campaign ID "Default").