BatShadow Group Uses New Go-Based 'Vampire Bot' Malware to Hunt Job Seekers [View all]

Oct 07, 2025
Ravie Lakshmanan

A Vietnamese threat actor named BatShadow has been attributed to a new campaign that leverages social engineering tactics to deceive job seekers and digital marketing professionals to deliver a previously undocumented malware called Vampire Bot.

"The attackers pose as recruiters, distributing malicious files disguised as job descriptions and corporate documents," Aryaka Threat Research Labs researchers Aditya K Sood and Varadharajan K said in a report shared with The Hacker News. "When opened, these lures trigger the infection chain of a Go-based malware."

The attack chains, per the cybersecurity company, leverage ZIP archives containing decoy PDF documents along with malicious shortcut (LNK) or executable files that are masked as PDF to trick users into opening them. When launched, the LNK file runs an embedded PowerShell script that reaches out to an external server to download a lure document, a PDF for a marketing job at Marriott.

The PowerShell script also downloads from the same server a ZIP file that includes files related to XtraViewer, a remote desktop connection software, and executes it likely with an aim to establish persistent access to compromised hosts.
https://thehackernews.com/2025/10/batshadow-group-uses-new-go-based.html?_m=3n%2e009a%2e3793%2eqb0ao44uux%2e2ty2