---
title: Vietnamese Hackers Target Job Seekers with 'Vampire Bot' Surveillance Malware
description: Beware of BatShadow's Vampire Bot malware targeting job seekers with fake PDFs, stealthily stealing sensitive data.
canonical_url: https://codekeeper.co/ticker/batshadow-vampire-bot-targets-job-seekers
---

# Vietnamese Hackers Target Job Seekers with 'Vampire Bot' Surveillance Malware

Beware of BatShadow's Vampire Bot malware targeting job seekers with fake PDFs, stealthily stealing sensitive data.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 9, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbatshadow-vampire-bot-targets-job-seekers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbatshadow-vampire-bot-targets-job-seekers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbatshadow-vampire-bot-targets-job-seekers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbatshadow-vampire-bot-targets-job-seekers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbatshadow-vampire-bot-targets-job-seekers%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbatshadow-vampire-bot-targets-job-seekers%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A Vietnam-based cyber group called BatShadow is targeting job seekers and digital marketing professionals with malicious emails containing "Vampire Bot" malware. The sophisticated surveillance tool, written in Go, continuously captures screenshots and steals sensitive data from infected computers. The attack works through zip files containing fake PDFs and hidden malicious executables. When victims open these files, PowerShell scripts quietly install the malware while displaying a decoy document. Vampire Bot then harvests system information, maintains persistence by hiding in core folders, and sends encrypted data to command servers. Researchers at Aryaka Threat Research Labs say the campaign exploits job seekers' willingness to open career-related emails, making them prime targets for cybercriminals seeking extended system access. **Source:** [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/vampire-bot-malware-job-hunters)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbatshadow-vampire-bot-targets-job-seekers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbatshadow-vampire-bot-targets-job-seekers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbatshadow-vampire-bot-targets-job-seekers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbatshadow-vampire-bot-targets-job-seekers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbatshadow-vampire-bot-targets-job-seekers%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbatshadow-vampire-bot-targets-job-seekers%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Data breaches Named Clients Deny They're in the 153M Driver's License Breach Sep 14, 2026](https://codekeeper.co/ticker/idscan-data-breach-exposes-153-million-licenses)

[Cyberattacks TanStack Attack Exposed 170 Private CrowdSec Repositories Sep 21, 2026](https://codekeeper.co/ticker/tanstack-npm-supply-chain-attack)

[BlackFile Cybercrime Group Targets Financial Giants with $3M Extortion Demands Aug 21, 2026](https://codekeeper.co/ticker/blackfile-cybercrime-targets-financial-firms)

[Teens Behind 2024 TfL Cyber-Attack Were Already on Police Radar Aug 12, 2026](https://codekeeper.co/ticker/tfl-cyber-attack-repeat-offenders)