The attack chain reportedly began with legitimate-looking phishing emails designed to lure victims into downloading a malicious attachment or visiting a fake login page. Once delivered, the dual-malware payload functioned as a remote access toolkit: TVRAT acted as the primary backdoor for command-and-control, while DarkVNC provided live screen capture and keystroke logging capabilities. Together, the tools allowed the attacker to wait for freelancers to log into financial or work-related portals, then perform unauthorized wire transfers directly from the victim’s session.

The indictment covers the suspect’s alleged use of money mules and cryptocurrency exchanges to launder the proceeds. It also highlights how the freelancer community, often dependent on platforms without corporate endpoint protection, became a prime target for these thefts. Authorities have urged gig-economy workers to enable hardware-based two-factor authentication and to treat unsolicited job-related messages with suspicion.

Source: BleepingComputer

For those of you operating as independent contractors or managing remote teams, how are you enforcing phishing resistance outside a traditional corporate perimeter?