Crowdstrike Recruitment Phishing

Sophisticated phishing campaigns impersonate legitimate companies like Crowdstrike through fake recruitment portals, SharePoint documents, and calendar invitations to harvest credentials and deploy malware. These multi-vector attacks exploit trusted communication channels and legitimate cloud services to bypass security controls. Victims who engage with these campaigns expose their login credentials.

Defend With SquareX

Create a user input policy to Block phishing sites.

Affected Companies:

Blogs:

Recruitment Phishing Scam Imitates CrowdStrike Hiring Process - CrowdStrike File hosting services misused for identity phishing - Microsoft Two-Step Phishing Campaign Exploits Microsoft Office Forms - Perception Point

Example Policy

Follow These Steps

Click on Launch Attack Simulation button
With SQRX enabled, webpage will be blocked

Details

A sophisticated phishing campaign impersonates CrowdStrike's recruitment process to deliver XMRig cryptocurrency mining malware. The attack begins with phishing emails claiming to be part of CrowdStrike's hiring process, directing victims to a malicious website that mimics legitimate recruitment portals. Victims are prompted to download a fake "employee CRM application" that serves as a downloader for the XMRig cryptominer. The malicious executable, written in Rust, performs sophisticated environment checks to evade detection including debugger detection, process enumeration, CPU core verification, and sandbox evasion before downloading and installing the cryptocurrency miner with persistence mechanisms.

Impact

Cryptocurrency Mining Resource Theft: The XMRig miner hijacks victim systems to mine Monero cryptocurrency, causing increased electricity costs, system performance degradation, and potential hardware damage through prolonged high CPU usage. System Compromise and Persistence: The malware establishes multiple persistence mechanisms through startup scripts, registry modifications, and file system artifacts, maintaining long-term access to compromised systems even after reboots. Corporate Network Infiltration: Employees falling victim to recruitment-themed attacks can introduce malware into corporate environments, potentially affecting business operations, network performance, and security infrastructure. Data Exfiltration Risk: While primarily focused on cryptocurrency mining, the malware's persistence mechanisms and network communication capabilities could be leveraged for additional malicious activities including data theft and lateral movement.

Indicator of Compromise (IOC)

System Performance Indicators: Unusual CPU usage spikes from unknown processes, increased electricity consumption and system temperature, network traffic to cryptocurrency mining pools, degraded system performance during normal operations, and unexpected system resource consumption during idle periods. Email and Social Engineering Indicators: Recruitment-themed phishing emails claiming job opportunities with cybersecurity companies, unsolicited employment offers requiring software downloads, fake interview invitations with malicious attachments, and social engineering attempts using trusted company branding and recruitment terminology. File System Artifacts: ZIP archives containing fake recruitment applications in temporary directories, Rust-compiled executables with recruitment-themed filenames, XMRig mining software downloaded to system temp folders, persistent copies of malware in LocalAppData System32 directories, and configuration text files containing base64-encoded mining parameters.