Seqrite uncovers ShadowRecruit malware targeting Indian job seekers

Seqrite, the enterprise security arm of Quick Heal Technologies, has revealed a malware campaign called Operation ShadowRecruit that targets Indian government job seekers. The attackers use a fake recruitment notice for Senior Field Officer positions in the Cabinet Secretariat, delivered via a ZIP archive containing a malicious LNK file, a PowerShell script, and a.NET executable. The malware deploys a custom remote access trojan named SheetAgent RAT, which uses Google Sheets as a backup command-and-control channel after initially abusing the legitimate ControlR remote management platform.

The campaign begins with a ZIP archive that appears to contain 'approved documents' but includes a disguised shortcut, a PowerShell downloader, and a hidden executable. The decoy document imitates an official recruitment notice with details such as eligibility criteria, vacancies, and deadlines, keeping the victim focused while the malware executes in the background. The final payload registers infected systems in a spreadsheet, reads commands from attacker-controlled cells, and writes results back, ensuring resilience even if one channel is disrupted.

The campaign affects government, education, and technology-oriented users in India. Seqrite's analysis shows the malware includes anti-analysis checks and cleanup routines to evade sandboxes. The threat aligns with trends in Seqrite's India Cyber Threat Report 2026, which documented a shift toward stealthier, automation-assisted attacks using cloud and collaboration platforms.