That “job brief” on Google Forms could infect your device

Malicious actors are running a campaign that lures victims with business-related Google Forms linking to ZIP files hosted on common file-sharing services; those ZIPs contain executables and a malicious DLL that leverages DLL hijacking to start a multi-stage infection culminating in PureHVNC RAT deployment. The chain uses obfuscated Python and Donut shellcode, achieves persistence via registry keys and scheduled tasks, collects browser and crypto-wallet data, and communicates with listed C2 infrastructure; the report includes IPs, URLs, and multiple file hashes as IOCs.