Fake Student Resume = Malware Delivery Vector (SNOWLIGHT + VShell Breakdown)
A new campaign is using fake graduate-school resumes to drop fileless malware on researchers' Windows machines. Not HR teams — professors and lab staff in electrical engineering, energy systems, and applied AI.
The lure: ZIP archive disguised as a Beijing Institute of Technology grad application. Inside: an executable with a document-style name, exploiting Windows' default extension-hiding behavior. Open the "resume," launch the .exe.
The chain:
- Custom Go loader checks for 4+ CPU cores (anti-sandbox)
- Uses
kernel32!Beepinstead ofSleep()to detect accelerated VM timing - Opens a genuine decoy DOCX so the victim sees nothing wrong
- Encrypted shellcode runs fully in memory — zero disk writes
That shellcode is SNOWLIGHT, a stager that decodes and hands off to a fileless build of VShell RAT — shell access, file transfer, screen capture, tunneling, all in-memory.
Attribution: deliberately narrow. Unattributed actor, mainland-China-oriented academic lure. SNOWLIGHT is now a default VShell-panel-generated stager, so tool overlap ≠ group ID.
Full writeup covers the complete attack chain, IOCs (hashes, C2 IP, AES/XOR keys), and PowerShell hunting commands for your SOC:
🔗 https://www.xpert4cyber.com/2026/08/fake-resume-malware-snowlight-vshell.html
