SolarMarker Impersonates Indeed to Spread Malware

eSentire’s Threat Response Unit uncovered a SolarMarker campaign that lures users via a fake Indeed page to download an AES-encrypted payload which deploys StellarInjector and SolarPhantom; the latter provides info-stealing and hidden VNC capabilities, stores stolen browser data in TEMP folders with XOR-based filenames, and uses legitimate digital certificates to evade detection. The report outlines the infection chain, technical artifacts, and points to IOCs and a full technical write-up on eSentire’s site.