The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Staffing/Recruiting
Breach intelligence, attack campaigns, and threat reports targeting the Staffing/Recruiting sector.
Explore Other Sectors
Staffing/Recruiting Threat Reports
WaterPlum Hackers Compromise 30,000 Devices in Massive Supply Chain Attack
Between December 2025 and July 2026, the North Korean hacking group WaterPlum executed a sophisticated supply chain attack through their "Contagious Interview" campaign, compromising over 30,000 devices across more than 100 countries. The attackers impersonated legitimate AI, cryptocurrency, and NFT companies to target job seekers with malicious npm packages and fake coding tests, ultimately stealing cryptocurrency credentials from over 7,000 wallets and transferring $10.7 million to North Korea. The operation combined social engineering with multiple malware families including BeaverTail, InvisibleFerret, and StoatWaffle to conduct financial theft and espionage. This incident highlights the evolving sophistication of state-sponsored supply chain attacks that exploit trusted development environments and social engineering tactics, demonstrating how nation-state actors are increasingly targeting individual developers and IT professionals to fund weapons programs while simultaneously infiltrating corporate networks.
5 days ago
Kill Chain
Inside the Lazarus Group's Fake IT Worker Employment Scam: A 2024 Investigation
Security researchers from ANY.RUN conducted an extensive investigation into North Korean IT worker infiltration schemes by creating a fake company to attract fraudulent job applicants. The study revealed sophisticated operations where Lazarus Group affiliates use stolen identities, AI-generated profile photos, and elaborate cover stories to secure remote positions at legitimate organizations. These fake employees then establish persistent access to corporate networks, potentially enabling data theft, intellectual property exfiltration, and deployment of malware while generating revenue for North Korean state operations. The investigation documented multiple phases of the scam including initial contact, identity verification circumvention, and operational security measures used by the infiltrators. This represents a significant evolution in state-sponsored cyber operations, blending traditional espionage with employment fraud to achieve long-term network access and financial gain for the DPRK regime.
3 weeks ago
Kill Chain
Unveiling PurpleDelta: The Sophisticated Fraudulent Employment Operation
Between late 2024 and early 2025, Recorded Future's Insikt Group identified multiple clusters of activity linked to 'PurpleDelta,' a designation for North Korean IT workers operating under fabricated personas. These operators applied to over 1,100 companies across sectors such as software, staffing, healthcare, and finance, submitting up to 60 applications daily. Utilizing AI-generated profile photos, custom ChatGPT assistants, and illicit identity documents, they secured employment at numerous organizations, posing significant insider threats. Once employed, PurpleDelta operatives recorded internal meetings, used screen recording software during work sessions, and coordinated via platforms like Telegram and Slack. Their activities are consistent with broader North Korean IT worker threats, presenting material risks to organizations hiring for remote technical roles. The sophistication and scale of PurpleDelta's operations underscore the evolving nature of cyber threats, particularly those involving state-sponsored actors leveraging advanced technologies to infiltrate organizations. This incident highlights the urgent need for companies to enhance their vetting processes for remote hires, implement robust monitoring systems, and stay vigilant against increasingly sophisticated social engineering tactics.
1 month ago
Kill Chain
CTM360's 'RecruitTrap' Campaign Unveils Sophisticated Phishing Tactics
In August 2026, CTM360 uncovered a large-scale phishing campaign named 'RecruitTrap,' involving over 3,000 malicious URLs designed to steal Google and Facebook credentials. The attackers impersonated recruiters from more than 50 organizations across 14 sectors, primarily targeting marketing professionals. Victims received unsolicited emails or meeting invitations leading to counterfeit interview scheduling pages. These pages employed Browser-in-the-Browser (BitB) techniques to display fake authentication pop-ups, tricking users into entering their credentials and multi-factor authentication codes, which were then relayed to the attackers in real time. This incident highlights the increasing sophistication of phishing attacks, particularly those leveraging BitB techniques to bypass traditional security measures. The focus on marketing professionals underscores the strategic targeting of roles with access to sensitive corporate resources, emphasizing the need for heightened vigilance and advanced security protocols to protect against such evolving threats.
1 month ago
Kill Chain
Brightly Software's 2023 Insider Threat: A Cautionary Tale
In December 2023, Cameron Curry, a data analyst contractor at Brightly Software, exploited his access to sensitive corporate data, including employee compensation information, to orchestrate an extortion scheme. After his contract ended, Curry sent over 60 threatening emails to Brightly's employees and executives, demanding approximately $2.5 million to prevent the release of the stolen data. The company reported the incident to the FBI on December 14, 2023, and ultimately paid $7,540.92 in ransom. Curry was arrested and, in March 2026, convicted on six counts of extortion, leading to a two-year prison sentence. This case underscores the significant risks associated with insider threats, particularly when contractors or employees have access to confidential information. Organizations must implement stringent access controls, continuous monitoring, and robust incident response plans to mitigate such risks. The incident also highlights the importance of promptly reporting breaches to authorities to facilitate swift legal action.
1 month ago
Kill Chain
North Korean Hackers Exploit Fake Coding Tests to Deploy OtterCookie Malware via Steganography
In July 2026, North Korean state-sponsored hackers initiated a sophisticated campaign targeting software developers through fake job postings and coding assessments. These assessments contained repositories with malicious code concealed within SVG image files, employing steganography to evade detection. Upon execution, the code deployed a multi-stage payload associated with the OtterCookie malware, capable of stealing browser credentials, cryptocurrency wallets, and sensitive files, as well as establishing remote access via a Socket.IO-based trojan. This operation underscores the persistent threat posed by North Korean cyber actors to the software development community, aiming to exfiltrate valuable data and financial assets. The use of steganography in SVG files highlights the evolving tactics employed by these adversaries to bypass traditional security measures, emphasizing the need for heightened vigilance and advanced detection capabilities within the industry.
2 months ago
Kill Chain
Major Brands Impersonated in Phishing Campaign Targeting Google Accounts
In July 2026, a sophisticated phishing campaign targeted marketing professionals by impersonating over 30 renowned brands, including Adobe, Netflix, Coca-Cola, and OpenAI. Attackers utilized legitimate platforms like PeopleForce and Salesforce Marketing Cloud to send fraudulent job interview invitations, leading recipients through a series of redirects to malicious landing pages designed to steal Google account credentials. The campaign employed real recruiters' names and photos to enhance credibility, exploiting nested redirects through trusted services to evade detection. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts/?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals who leverage legitimate platforms and trusted brand identities to execute credential theft. The use of nested redirects and impersonation of real recruiters highlight the need for heightened vigilance and advanced security measures to protect against such deceptive attacks.
2 months ago
Kill Chain
Palo Alto Networks' 2025 Data Breach: A Supply Chain Attack via Salesloft Drift
In August 2025, Palo Alto Networks experienced a significant data breach resulting from a supply chain attack targeting the Salesloft Drift platform. Attackers exploited stolen OAuth tokens to gain unauthorized access to Salesforce environments, leading to the exfiltration of sensitive data, including business contacts, internal sales records, and support case information. The breach affected hundreds of organizations globally, with Palo Alto Networks among the impacted entities. ([techradar.com](https://www.techradar.com/pro/security/palo-alto-networks-becomes-the-latest-to-confirm-it-was-hit-by-salesloft-drift-attack?utm_source=openai)) This incident underscores the escalating risks associated with third-party integrations and the critical need for robust supply chain security measures. The attack highlights the importance of vigilant monitoring and rapid response strategies to mitigate potential vulnerabilities in interconnected systems. ([breached.company](https://breached.company/major-supply-chain-attack-palo-alto-networks-and-zscaler-hit-by-salesloft-drift-breach/?utm_source=openai))
6 months ago
Kill Chain
Cybercriminals Exploit Fake Resumes to Deploy Cryptominers in Corporate Networks
In March 2026, a sophisticated phishing campaign targeted French-speaking corporate environments by distributing emails with fake resumes. These emails contained highly obfuscated VBScript files disguised as CV documents. When executed, the scripts deployed cryptocurrency miners and information-stealing malware on the victims' systems, leading to unauthorized resource utilization and potential data breaches. This incident underscores the evolving tactics of cybercriminals who exploit common business processes, such as recruitment, to infiltrate organizations. The use of obfuscated scripts and the dual payload of cryptominers and infostealers highlight the need for enhanced email security measures and user awareness training to detect and prevent such multifaceted attacks.
6 months ago
Kill Chain
Insider Threat: North Carolina Tech Worker Convicted in $2.5M Data Extortion Case
In December 2023, Cameron Curry, a 25-year-old contract employee from North Carolina, exploited his access to a Washington D.C.-based technology company's sensitive data. Upon learning his contract would not be renewed, Curry stole confidential employee information and, under the alias "Loot," sent over 60 emails threatening to publish the data unless a $2.5 million ransom was paid. The company reported the extortion to the FBI on December 14, 2023, and subsequently paid the ransom in January 2024. Curry was arrested on January 24, 2024, after authorities traced the extortion communications and cryptocurrency transactions back to him. He pleaded guilty to felony extortion on September 27, 2024, and faces sentencing on January 28, 2025. This incident underscores the significant risks posed by insider threats, especially when employees or contractors have access to sensitive information. Organizations must implement robust access controls, monitor for unusual activities, and foster a culture of security awareness to mitigate such risks.
6 months ago
Kill Chain
BlackSanta Malware: A New Era of Targeted Cyber Threats in HR Workflows
In early 2026, Russian-speaking threat actors initiated the 'BlackSanta' campaign, targeting human resources (HR) workflows to deploy sophisticated malware capable of disabling endpoint detection and response (EDR) systems. The attack begins with resume-themed ISO files delivered through recruitment channels, which, when opened, execute malicious shortcuts that trigger a multi-stage infection chain. This chain includes obfuscated PowerShell commands extracting payloads from steganographic images and sideloading malicious DLLs via legitimate applications. Once executed, the malware performs extensive validation to evade analysis environments before deploying the 'BlackSanta' EDR killer. This component loads legitimate but exploitable kernel drivers to gain low-level system access, subsequently disabling security protections, including antivirus processes, EDR agents, and system logging. This enables attackers to exfiltrate sensitive data over encrypted HTTPS channels with minimal detection risk. The campaign underscores the increasing sophistication of cyber threats targeting operational business workflows, particularly in HR environments. Organizations are advised to apply rigorous security measures to HR systems, including enhanced endpoint protections, monitoring for unusual activity, and increasing security awareness among recruiting teams to mitigate such attacks.
6 months ago
Kill Chain
North Korean Hackers Exploit Fake Job Interviews to Target Crypto Developers
In early 2026, North Korean state-sponsored hackers, notably the Lazarus Group, intensified their cyberattacks by posing as recruiters targeting JavaScript and Python developers in the cryptocurrency sector. They initiated contact through platforms like LinkedIn, offering fake job opportunities that included coding challenges embedded with malicious code. Upon execution, these challenges installed malware designed to steal cryptocurrency and sensitive information from the victims' systems. ([techradar.com](https://www.techradar.com/pro/security/north-korean-job-scammers-target-javascript-and-python-developers-with-fake-interview-tasks-spreading-malware?utm_source=openai)) This incident underscores a significant evolution in cyberattack strategies, highlighting the increasing sophistication of social engineering tactics. The use of trusted platforms and realistic job offers to deliver malware emphasizes the need for heightened vigilance among professionals in the tech and cryptocurrency industries.
7 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports