The financially driven threat entity recognized as FIN6 has been seen utilizing counterfeit resumes hosted on Amazon Web Services (AWS) infrastructure to distribute a malware variant named More_eggs.
“By impersonating job applicants and starting discussions via platforms such as LinkedIn and Indeed, the group establishes connections with recruiters before sending phishing communications that result in malware,” the