New Warmcookie Windows backdoor pushed via fake job offers

Elastic Security Labs reports an active phishing campaign delivering the Warmcookie Windows backdoor via fake job/recruitment emails that redirect victims to pages prompting CAPTCHA and downloading an obfuscated JavaScript which runs a PowerShell script to use BITS and rundll32.exe to deploy C:\ProgramData\RtlUpd\RtlUpd.dll; the malware creates a scheduled task ('RtlUpd') to maintain persistence, fingerprints hosts, captures screenshots, enumerates installed software, executes commands, exfiltrates data via HTTP cookie parameters, and can drop additional payloads — the campaign is ongoing with new domains spun up weekly and was previously observed by eSentire in 2023.