Cyberattackers Use HR Targets to Lay More_Eggs Backdoor

Trend Micro observed a spear‑phishing campaign that impersonates job applicants to deliver the "more_eggs" JScript backdoor (part of the Golden Chickens MaaS), likely linked to FIN6. The attackers used convincing fake-resume websites, malicious .lnk/.zip files and social engineering to target recruiters and roles with access to valuable assets; IoCs and detection/mitigation guidance were shared.