That “job brief” on Google Forms could infect your device

This report describes an active campaign that uses convincing Google Forms (often promoted via LinkedIn) to host links to ZIP archives containing malicious payloads which ultimately deploy the PureHVNC RAT. The chain abuses DLL sideloading, obfuscated Python scripts that load Donut shellcode, and process injection to achieve persistence and exfiltrate browser data and cryptocurrency wallets; the report includes C2 details, URLs and multiple file hashes, plus defensive recommendations.