Vampire Bot Malware Sinks Fangs Into Job Hunters

A Vietnam-based threat group known as BatShadow is targeting job seekers and digital marketing professionals with phishing emails that deliver Vampire Bot malware designed for surveillance and data theft.

According to Aryaka Threat Research Labs, the campaign relies on zip archives containing lure PDFs and hidden malicious files that install the malware once opened; Vampire Bot is tracked by Aryaka and is designed to profile compromised systems, hide itself to maintain persistence, and continuously capture screenshots for operator visibility and control.

The malware, written in Go, can exfiltrate screenshots and other system information to its C2 server and checks in for new commands and payloads, while deploying additional components via PowerShell scripts under the guise of a fake PDF. The attackers embed malicious code into familiar job-application workflows to increase compromise likelihood while reducing detection.

The authors note BatShadow is part of a broader cluster of Vietnamese cyber gangs targeting both domestic and foreign organisations, with OceanLotus, Ocean Buffalo and CoralRaider named as other examples in the region.