WarmCookie Gives Cyberattackers Tasty New Backdoor for Initial Access

Elastic Security Labs describes WarmCookie, a two-stage Windows backdoor being distributed widely by the REF6127 recruitment-themed phishing campaign; the attack chain uses obfuscated JavaScript and PowerShell (including a CAPTCHA-based landing page), BITS to download a DLL, and a scheduled task named RtlUpd for persistence, while the backdoor performs reconnaissance and can stage ransomware. Researchers note active daily distribution, code overlap with older samples, multiple anti-analysis and obfuscation techniques, and provide YARA rules and behavior-based detections for defenders.