Help Wanted: Vietnamese Actors Using Fake Job Posting Campaigns to Deliver Malware and Steal Credentials

A financially motivated Vietnamese threat actor group UNC6229 is conducting a campaign using fake job postings on legitimate platforms to target remote workers in digital advertising and marketing. They create credible fake company profiles and lure victims with attractive remote job offers. Upon victim engagement, they deliver malware attachments or phishing links, often leveraging legitimate business and CRM platforms to increase trust. The goal is to steal credentials and compromise high-value corporate and digital advertising accounts. The campaign relies heavily on social engineering and victim-initiated contact. Indicators include malware hashes and a suspicious domain (staffvirtual.website). This medium-severity threat poses risks to confidentiality and integrity of corporate accounts, especially in organizations with remote digital advertising staff.

• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• Inside a brand deal scam targeting YouTube creatorsCampaign2026-10-12
• Behind the Connect Button: The Fake AI Ads CampaignCampaign2026-10-07
• Phishing Abuses RMM Tools for Persistent AccessMalware2026-09-29