SheetAgent

Operation ShadowRecruit: A Recruitment-Themed Malware Campaign Leveraging ControlR and Google Sheets to Target Indian Job Seekers - Malware News - Malware Analysis, News and Indicators

Researchers reported a recruitment-themed malware campaign targeting Indian government job seekers with a fake Cabinet Secretariat notice for Senior Field Officer roles. The infection chain delivers a ZIP archive containing a malicious .lnk file, a PowerShell script, and a .NET executable that installs the legitimate ControlR remote management agent alongside a custom RAT called SheetAgent. The malware persists through a scheduled task or Startup-folder shortcut, disguises files with Windows-like names, and uses anti-VM, anti-sandbox, and self-cleanup checks to hinder analysis. Seqrite said SheetAgent uses hardcoded Google service account credentials to access Google Sheets and Google Drive, with an attacker-controlled sheet acting as a backup command-and-control and exfiltration channel. Investigators also linked infrastructure at 38.242.157.89 to the decoy PDF and several authenticated management panels, including SecureMonitor and PrivateRat. The tradecraft overlaps with earlier campaigns that used cloud services such as Google Sheets, Firebase, GitHub, and Microsoft Graph for covert C2 against Indian targets, and Seqrite attributed the operation to APT36 with medium confidence.

Operation ShadowRecruit: A Recruitment-Themed Malware Campaign Leveraging ControlR and Google Sheets to Target Indian Job Seekers | Seqrite