AhnLab ASEC blog (asec.ahnlab.com)
BeaverTail and Tropidoor Malware Distributed via Recruitment Emails · 2025-04-02
excerpt: On November 29, 2024, a case was disclosed in which threat actors impersonated a recruitment email from a developer community called Dev.to to distribute malware. [1] In this case, the attacker provided a BitBucket link containing a project, and the victim discovered malicious code within the project and disclosed it to the community. The project […] | attribution sentence: The “car.dll” downloader is characterized by implementing Windows commands internally, similar to the LightlessCan malware of the Lazarus group disclosed in a past ESET report. | target sentence: Inside the project file BeaverTail is known to be distributed primarily in phishing attacks disguised as job offers, such as the ones targeting LinkedIn users.