Threat Actors with Fake Job Lures Attacking Job Seekers to Deploy Advanced Malware

Iranian threat actors are exploiting job seekers’ aspirations through sophisticated fake recruitment campaigns designed to deploy advanced malware across Europe’s critical infrastructure sectors, according to Check Point Research. The operation, led by Nimbus Manticore, also known as UNC1549 or Smoke Sandstorm, constructs elaborate fake recruitment websites that impersonate major aerospace companies such as Boeing, Airbus, Rheinmetall, and flydubai.

These portals use React templates to replicate branding and employ a unique login credential system delivered in advance via spear-phishing, with access granted only when the correct credentials are entered, allowing the distribution of weaponised archives containing malware.

The campaign targets defence, telecommunications, and aerospace organisations and has expanded geographically to Western Europe, focusing on Denmark, Sweden, and Portugal, with infrastructure concealed behind Cloudflare services to maintain legitimacy and operational security. The malware arsenal has evolved from the Minibike implant to MiniJunk and MiniBrowse, emphasising long-term persistence and data exfiltration, while threat groups adapt techniques across campaigns to broaden espionage objectives.