New Phishing Campaign Deploys WARMCOOKIE Backdoor Targeting Job Seekers

Researchers disclosed an active global phishing campaign (tracked as REF6127) leveraging recruitment-themed emails and compromised infrastructure to deliver a Windows backdoor called WARMCOOKIE. Victims are lured to download an HTML/JS payload that runs obfuscated PowerShell to abuse BITS and fetch a DLL backdoor compiled with hard-coded C2 IP and RC4 key; WARMCOOKIE establishes persistence, performs anti-analysis and host fingerprinting, captures screenshots, executes commands, manipulates files, and is used to stage additional payloads.