Seqrite, the enterprise security arm of Quick Heal Technologies Limited, a global provider of cybersecurity solutions, has unveiled key insights into Operation ShadowRecruit, a recruitment-themed malware campaign targeting Indian government job seekers through a fake recruitment notice for Senior Field Officer positions in the Cabinet Secretariat. The campaign uses a ZIP archive containing a malicious LNK file, a PowerShell script, and a .NET executable to establish access, deploy a custom remote access trojan and maintain a covert command-and-control channel.
Researchers at Seqrite Labs, India’s largest malware analysis facility, found that the attackers also abuse the legitimate ControlR remote management platform during infection, then fall back on Google Sheets as a backup command-and-control channel for the final payload, which Seqrite names SheetAgent RAT. The malware registers infected systems in a spreadsheet, reads commands from attacker-controlled cells and writes results back, allowing the operation to continue even when one channel is disrupted.
The campaign begins with a ZIP archive that appears to contain “approved documents,” but actually includes a malicious shortcut, a PowerShell downloader and a hidden executable. The LNK file is disguised with a browser icon and launches the PowerShell stage in hidden mode, which downloads and enrolls the victim machine into ControlR before triggering the .NET dropper. The dropper then creates persistence via a scheduled task or startup shortcut, while a decoy recruitment document distracts the target on screen
The lure is tailored to Indian job seekers, especially those applying for government roles, making the campaign highly credible and socially engineered. The decoy document imitates an official recruitment notice and includes details such as eligibility criteria, vacancies, application instructions and deadlines, all designed to keep the victim focused on the fake opportunity while the malware executes in the background.
The final payload, SheetAgent RAT, is built to be resilient and operationally flexible. It uses hardcoded Google service account credentials to access Google Sheets and Google Drive APIs, enabling the attacker to issue commands through spreadsheet cells, store victim information, and retrieve execution output from infected systems. Seqrite’s analysis also shows that the malware includes anti-analysis checks and cleanup routines to evade virtualised environments and remove traces when it detects a sandbox.
The campaign affects government, education and technology-oriented users in India, underscoring how public-sector recruitment themes remain effective across multiple audiences. This reflects a broader pattern in which attackers exploit trust in official-looking notices and familiar productivity tools to bypass suspicion, rather than relying solely on noisy malware delivery. The threat aligns with trends highlighted in Seqrite’s India Cyber Threat Report 2026, which documented a shift toward stealthier, automation-assisted attacks, and the growing use of cloud and collaboration platforms in intrusion chains.
In this context, Seqrite DRPS can help organisations spot and disrupt the external infrastructure that supports campaigns like ShadowRecruit, including malicious domains, impersonation assets and related web-based threat surfaces. Seqrite Data Privacy also emerges as a must-have for organisations handling sensitive applicant, employee and operational records, since campaigns that start as recruitment lures often end in credential theft or data exposure. All Seqrite products are compliant with the provisions of the DPDP Act, helping organisations strengthen both security and regulatory readiness.
