Follow-up: fake recruiter email campaign has been taken down
An oss-sec mailing list follow-up reports that a fake recruiter campaign, using engineering job emails that led to a bash script, has been taken down. The registrar applied a clientHold to the domain on 10 October 2026.
The follow-up was published on 15 October 2026 in the oss-sec list feed and is a machine translation of an incident update. According to the text, the earlier campaign used fake engineering job emails. These emails led victims to an initialization bash script that they were induced to paste into a terminal. The material describes a file of about 50 KB, a command and control server, a second stage encoded in base64 written to a temporary directory, and self-deletion to hinder forensic analysis. SHA-256 hashes are also cited as technical indicators. The registrar applied clientHold on 10 October 2026, and the notice marks the case as resolved.
The received text is cut off before the full timeline, so intermediate dates cannot be detailed. This summary adds no indicators beyond those in the source.
To consult and verify the original, open the public oss-sec list archive for the fourth quarter of 2026, and compare the hashes and domain history with independent sources before making any operational decision.