MalwareMar 10, 2026
'BlackSanta' EDR Killer Targets HR Workflows
A Russian-speaking cybercriminal campaign dubbed 'BlackSanta' delivers EDR-killing malware through hijacked HR workflows to compromise security defenses and enable undetected data theft. The attack leverages workflow automation to bypass endpoint detection and response solutions, allowing attackers to operate covertly within compromised environments.
Summary
A Russian-speaking cybercriminal campaign dubbed 'BlackSanta' delivers EDR-killing malware through hijacked HR workflows to compromise security defenses and enable undetected data theft. The attack leverages workflow automation to bypass endpoint detection and response solutions, allowing attackers to operate covertly within compromised environments.
Indicators of Compromise
- malware — BlackSanta