This "Dream Job" campaign has been active since at least September 2023, with the goal of phishing people working in the aerospace, aviation, and defense industries, particularly in Israel and Eastern Europe. "This suggests a strategic interest in acquiring sensitive information and potentially disrupting operations within these critical sectors,” Clear Sky says in its report.

Suspected Iranian hackers have been spreading malware through fake job offers that fool targets into downloading a malicious ZIP file, according to a cybersecurity firm.

"The campaign distributed the SnailResin malware, which activates the SlugResin backdoor," Israeli cybersecurity company ClearSky said in a Tuesday analysis. TA455, also tracked by Google-owned Mandiant as UNC1549 and Yellow Dev 13,