BatShadow Group Uses New Go-Based 'Vampire Bot' Malware to Hunt Job Seekers

According to Aryaka Threat Research Labs researchers Aditya K Sood and Varadharajan K, a Vietnamese threat actor named BatShadow has launched a new campaign that uses social engineering to lure job seekers and digital marketing professionals into installing a Go-based malware called Vampire Bot. The attackers pose as recruiters, distributing malicious files masquerading as job descriptions and corporate documents, with infection triggered when the lure is opened.

The chain uses ZIP archives containing decoy PDFs alongside malicious LNK or executable files masquerading as PDFs to coax users into launching them, after which a PowerShell script downloads a lure document and a ZIP that includes XtraViewer, a remote desktop tool, aiming to establish persistence.

Victims who click a link in the lure PDF are redirected to a landing page that pushes Edge as the only supported browser, before the URL is launched in Edge to download a malware bundle including a Marriott Marketing Job Description PDF.exe. Vampire Bot is capable of profiling hosts, stealing data, capturing screenshots at intervals, and communicating with an attacker-controlled server to receive commands or payloads, with the infrastructure linked to api3.samsungcareers[.]work.

BatShadow has been active for at least a year, and prior campaigns used similar domains to spread malware families such as Agent Tesla, Lumma Stealer, and Venom RAT.