Help Wanted: Vietnamese Actors Using Fake Job Posting Campaigns to Deliver Malware and Steal Credentials

GTIG warns of a financially motivated campaign (UNC6229) that uses fake job postings to socially engineer victims into opening password-protected attachments or visiting phishing pages; payloads include RATs and credential-harvesting pages capable of handling MFA. The actors abuse legitimate CRM and SaaS platforms to improve deliverability, have been linked to infrastructure reuse, and are actively disrupting and sharing indicators to mitigate the threat.