Google Forms Job Lures Deliver PureHVNC in New Multi-Stage Malware Campaign
A recent cybersecurity campaign has emerged, utilizing Google Forms to distribute malware. This campaign targets users by disguising itself as legitimate business communications, such as job interviews and project briefs, to deploy a Remote Access Trojan…
A recent cybersecurity campaign has emerged, utilizing Google Forms to distribute malware. This campaign targets users by disguising itself as legitimate business communications, such as job interviews and project briefs, to deploy a Remote Access Trojan (RAT) known as PureHVNC.
The campaign starts with a convincing Google Form that mimics real recruitment or business processes. These forms collect professional details to enhance credibility. Upon submission, users are redirected to download a business-themed ZIP file, hosted on various platforms, including Dropbox and fshare.vn, or accessed through link shorteners.
Additionally, attackers distribute these links via LinkedIn, targeting professionals seeking new opportunities. The forms often impersonate reputable companies, making it difficult for users to identify the threat.
PureHVNC is a modular .NET RAT that provides attackers with complete remote control over the compromised system. It can execute commands, steal data from browsers and cryptocurrency wallets, gather system information, and install additional plugins. The malware's configuration is encoded in base64 and compressed with GZIP, with an identified C2 server at IP 207.148.66.14 operating on ports 56001, 56002, and 56003.
A recent cybersecurity campaign has emerged, utilizing Google Forms to distribute malware.
The infection process of PureHVNC is structured to evade detection. After extracting the downloaded ZIP file, users find a hidden executable and a DLL named msimg32.dll . This DLL is executed through DLL hijacking, which loads malicious code without triggering alerts. It checks for debugging environments and halts if detected.
The DLL then self-deletes, drops a fake PDF to distract the user, and establishes persistence by adding a registry entry at CurrentVersion\Run\Miroupdate . Subsequently, a hidden archive named final.zip is extracted, containing an obfuscated Python script that launches Donut shellcode in memory, injecting PureHVNC into SearchUI.exe .
Verify the source of Google Forms before submitting information or downloading linked files. Cross-check unexpected job offers through official company websites and known contacts. Avoid clicking on links hidden by URL shorteners without verification. Security teams should monitor for unusual DLL loads, encoded PowerShell task creation, and process injection activities. Ensure endpoint defenses are updated to detect anomalous Python processes in ProgramData directories.
Based on reporting by Cyber Security News.