'Venom Spider' Targets Hiring Managers in Phishing Scheme
ID: 03d37ab5-24cd-5df0-961b-65d13b188aa0
STIX ID: report--03d37ab5-24cd-5df0-961b-65d13b188aa0
Feed Name: Dark Reading
Date Published: 2025-05-05
Date Updated: 2026-04-21
Author: Alexander Culafi, Senior News Writer, Dark Reading
Venom Spider is running a targeted spear-phishing campaign against recruiters and hiring managers by delivering polymorphic resume-themed archives that drop a More_eggs_Dropper and ultimately the More_eggs backdoor; the chain uses .ink/.lnk files, .bat scripts, legitimate Windows binaries (ie4uinit.exe, msxsl.exe) to execute obfuscated JavaScript and evade analysis, and has been active recently (since at least October 2023) with historical activity back to 2018.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.