Hackers Use Fake Student Resume to Secretly Install Malware on Researchers’ Computers

A fake student resume is being used to place a remote-access tool on researchers’ Windows computers. The campaign hides a Windows executable inside an archive that appears to contain a graduate-school application, then opens a genuine Word document while the infection runs quietly in the background.

The lure claims to come from a recent Beijing Institute of Technology graduate seeking research work in electrical engineering, energy systems and applied AI.

That focus points to professors and laboratory staff as likely targets, rather than ordinary corporate recruiters, and turns academic correspondence into a route for intrusion.

Himanshu Anand said in a report shared with Cyber Security News (CSN) that the attack delivers SNOWLIGHT and the VShell remote-access trojan through a multi-stage, memory-based chain.

The evidence supports targeted access to a research workstation, but does not establish the operator’s identity, nationality or final objective.

The incident shows why academic staff need the same caution applied to hiring teams. A believable application exploits the expectation that researchers will review unfamiliar files, while the decoy document gives victims little reason to suspect trouble.

Fake Resume Targets Researchers

The malicious ZIP archive uses a Chinese-language name that presents its supposed author as Zhang Yuguang, a network-engineering graduate. Inside is an executable with a near-identical document-style name, relying on Windows hiding known file extensions by default.

Once opened, the loader retrieves and launches a real DOCX resume, allowing the recipient to read the expected application.

At the same time, it checks for an analysis environment, refuses systems with fewer than four CPU cores, and uses an unusual timing test before continuing.

The decoy makes claims about AI-based power-grid fault diagnosis, renewable-energy control and joining a supervisor’s research group, suggesting that the attacker tailored it for technical academics.

Similar lures appear in this report on academic event material attacks, where trusted research context also served as cover. The university name gives the application credibility, but it is not evidence that the institution created, knew about or received the malware.

Anand assessed a mainland Chinese academic recipient as the most likely target context, while keeping attribution to the operator unresolved.

The initial program downloads encrypted shellcode and runs it in memory instead of saving a conventional payload to disk. This fileless approach can make routine disk-based checks less useful, as explained in coverage of how fileless malware works, while allowing the decoy to stay open.

SNOWLIGHT Opens Remote Access

The Windows SNOWLIGHT shellcode contacts the command server, sends a short system check-in and receives a 4.65 MB payload. It decodes that payload and transfers execution to VShell, which registers with the same server over encrypted traffic.

That sequence gave the attackers a remote-access foothold. The sample completed VShell registration and health checks, although the analysis did not capture an operator typing commands, transferring files or moving to another system.

Confirmed behavior must remain separate from capabilities that could be used later. VShell can provide an interactive command shell, file transfer, screen capture, network discovery and tunneling.

Its wider campaign use is examined in VShell threat actor adoption, but the framework alone does not identify a particular threat group.

That distinction matters here. SNOWLIGHT and VShell have appeared in activity associated with several clusters, yet are now available more widely.

The report therefore describes an unattributed actor using a mainland-China-oriented academic lure, not a confirmed state-linked operation.

Researchers, departments and IT teams should verify unsolicited applications through a separate contact channel before opening files.

They should enable visible extensions, block executable content in unexpected archives, and investigate resume-themed programs that start command shells, Word or unusual outbound connections.

Similar recruitment scams have targeted business teams through fake resume malware campaigns, showing that the social-engineering pattern extends beyond academia.

Security teams should hunt for the listed network destinations, resume-themed executables and the temporary marker associated with this chain, reviewing related process and network telemetry.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Use Fake Student Resume to Secretly Install Malware on Researchers’ Computers appeared first on Cyber Security News.