Google Forms Job Scam Spreads PureHVNC Malware

A newly identified malware campaign is leveraging trusted platforms such as Google Forms to distribute the PureHVNC Remote Access Trojan (RAT). This approach represents a shift in how attackers initiate infections, moving away from traditional phishing emails or malicious websites.

Threat actors are employing business-themed lures, including job interviews, project proposals, and financial documents, to deceive victims into downloading malware. The process begins with a seemingly legitimate Google Form impersonating well-known companies in sectors like finance, logistics, and technology. These forms request professional details, mimicking authentic recruitment or partnership workflows.

Victims are then directed to download a ZIP archive hosted on file-sharing platforms like Dropbox, filedn.com, or fshare.vn, often masked behind URL shorteners or Google redirect links. The ZIP files carry business-relevant names such as “Project_Information_Summary_2026.zip” or “Company_Project_Interview_Materials.zip.”

Inside, victims typically find a combination of legitimate-looking documents, such as PDFs, alongside malicious executables and a DLL file named msimg32.dll used to trigger the infection chain via DLL hijacking. The forms convincingly impersonate real companies, incorporating authentic logos and links, and platforms like LinkedIn are used to distribute the links to these malicious forms.

Once executed, the malicious DLL initiates a multi-stage process designed to evade detection and establish persistence. The malware decrypts embedded strings using a simple XOR key (“4B”) and performs anti-analysis checks using functions like IsDebuggerPresent() and time64(). If debugging is detected, it halts execution with a fake error message.

Subsequently, the malware deletes itself, launches a decoy PDF to distract the user, and creates persistence through the Windows registry key CurrentVersion\Run\Miroupdate. It extracts a secondary archive named “final.zip” into a randomly generated directory under ProgramData using command-line tools like tar.

This archive contains Python-based components, including an obfuscated script (often disguised as files like config.log or image.mp3). This script executes via pythonw.exe and ultimately decodes and runs the Donut shellcode, leading to the final payload deployment.

The final stage involves injecting PureHVNC into legitimate processes such as SearchUI.exe. Once active, the RAT grants attackers full remote control over the compromised system. It collects extensive system information using WMI queries, including antivirus status, operating system details, and connected imaging devices.

PureHVNC also performs data exfiltration, targeting browsers, extensions, and cryptocurrency wallets, along with applications like Telegram and Foxmail. It supports modular plugins, allowing attackers to extend functionality as needed. Persistence is further reinforced through scheduled tasks created via base64-encoded PowerShell commands, often executed with elevated privileges.

This campaign is particularly effective due to its abuse of trusted platforms. By using Google Forms, LinkedIn, and legitimate file-hosting services, attackers exploit user trust and bypass traditional security filters. The malware communicates with command-and-control servers at IP address 207.148.66.14 over ports 56001–56003. Configuration data is encoded using base64 and compressed with GZIP, including identifiers like mutex name “Rluukgz” and campaign ID “Default.”

Users and organizations should remain cautious when dealing with unsolicited job offers or project requests. Avoid downloading files from unfamiliar Google Forms or clicking on shortened URLs without verification. Always confirm the legitimacy of such requests through official company channels.

This campaign underscores how attackers are evolving their delivery mechanisms, shifting focus from malware sophistication to social engineering and trusted platforms to achieve initial access.

Based on reporting by GBHackers.