Google Forms Weaponized: New “PureHVNC” Campaign Targets Professionals via LinkedIn

Malwarebytes Labs uncovered a targeted campaign that lures professionals via LinkedIn and branded Google Forms to download ZIP archives (hosted on Dropbox or via Google redirects) containing a malicious executable and hidden DLL which deploys the PureHVNC RAT; the malware provides remote execution, data theft from browsers/crypto wallets and apps (Telegram, Foxmail), persistence via scheduled PowerShell tasks, and uses DLL hijacking, WMI checks, and sandbox/debugger detection for evasion—users should not run executables to view documents and must verify sources.