--- title: "That Employee You Want to Hire May be a Hacker | DuoCircle" description: "You have to hand it to hackers. They’re always coming up with new ways to slip some malware passed unsuspecting email recipients." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/email-security/that-employee-you-want-to-hire-may-be-a-hacker/" --- Quick Answer Attackers now disguise malware as inbound resumes to HR. Bleeping Computer reported a campaign using a fake job application from "Eva Richter" carrying an executable masked as a PDF that drops Ordinypt Wiper, malware that pretends to be ransomware but actually overwrites files with garbage so they cannot be decrypted even if a ransom is paid. The HR inbox is an attractive target because it routinely receives unsolicited attachments from strangers. Defenses: scan every attachment for executable content, block double extensions and disguised binaries at the gateway, train HR to open resumes only after extracting and inspecting them, and prefer applicant tracking systems with built-in file sanitization over direct email submission. Email security with attachment sandboxing catches the wiper before it lands in a recruiter's mailbox. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Femail-security%2Fthat-employee-you-want-to-hire-may-be-a-hacker%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=That%20Employee%20You%20Want%20to%20Hire%20May%20be%20a%20Hacker&url=undefined%2Fblog%2Femail-security%2Fthat-employee-you-want-to-hire-may-be-a-hacker%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Femail-security%2Fthat-employee-you-want-to-hire-may-be-a-hacker%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Femail-security%2Fthat-employee-you-want-to-hire-may-be-a-hacker%2F&title=That%20Employee%20You%20Want%20to%20Hire%20May%20be%20a%20Hacker "Share on Reddit") [ ](mailto:?subject=That%20Employee%20You%20Want%20to%20Hire%20May%20be%20a%20Hacker&body=Check out this article: undefined%2Fblog%2Femail-security%2Fthat-employee-you-want-to-hire-may-be-a-hacker%2F "Share via Email") ![Hacker](https://media.mailhop.org/duocircle/images/2019/09/windows-smtp-service-6247.jpg) You have to hand it to hackers. _They’re always coming up with new ways to slip some malware passed unsuspecting email recipients_. It’s not uncommon today for prospective employees to email their resume to the HR department of the hiring company in an effort to land a job. What is uncommon, or at least _it was until recently, was for that resume to contain malware_. [![spam campaign](https://media.mailhop.org/duocircle/images/2019/09/buy-smtp-8362.jpg)](https://media.mailhop.org/duocircle/images/2019/09/buy-smtp-8362.jpg) Now, according to [Bleeping Computer](https://www.bleepingcomputer.com/news/security/destructive-ordinypt-malware-hitting-germany-in-new-spam-campaign/), “A new **spam campaign** is underway that pretends to be a job application from ‘Eva Richter’ who is sending her photo and resume. This resume, though, is actually an executable masquerading as a PDF file that destroys a victim’s files by installing the **Ordinypt Wiper**.” “Ordinypt is a destructive malware commonly targeted at German people that pretends to be **ransomware** that encrypts your files and then demands victim’s pay a ransom to get their files back. Unfortunately, even if a user pays the ransom, _the files have been overwritten with garbage and cannot be decrypted_.” [![phishing protection](https://media.mailhop.org/duocircle/images/2019/09/smtp-3285.jpg)](https://media.mailhop.org/duocircle/images/2019/09/smtp-3285.jpg) This is just one more example of why companies need to invest in [spam filtering](/email/spam-filtering) and [phishing protection](/email/phishing-protection) software. _It’s because hackers are clever and will never stop probing to find a human weakness to exploit_. And when they do exploit it, there had better be some **backup protection** in place. If you’re in need of the full suite of software protection services for your company, have a look at our [email security services](/). It’s got all the **email protection** you’ll ever need including scanning attachments for executable files. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-security%2Fthat-employee-you-want-to-hire-may-be-a-hacker%2F) [ ](https://twitter.com/intent/tweet?text=That%20Employee%20You%20Want%20to%20Hire%20May%20be%20a%20Hacker&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-security%2Fthat-employee-you-want-to-hire-may-be-a-hacker%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-security%2Fthat-employee-you-want-to-hire-may-be-a-hacker%2F) Copy Related Articles - [ BIMI in 2026: What the Certificate Authority Does, and What Your DMARC Tool Does Email Security ](/blog/bimi-2026-what-the-ca-does-what-your-dmarc-tool-does/) - [ ![Designing A Custom Dkim Architecture For High-Volume Email Senders](https://media.mailhop.org/duocircle/images/2026/04/buy-smtp-1290.jpg) Designing A Custom Dkim Architecture For High-Volume Email Senders Email Security ](/blog/designing-custom-dkim-architecture-for-high-volume-email-senders/) - [ ![DMARC, SPF, and DKIM](https://media.mailhop.org/duocircle/images/2026/04/spf-record-4526.jpg) DMARC, SPF, and DKIM in 2026: Why Email Authentication Is Now a Regulatory Requirement, Not Just a Best Practice Email Security ](/blog/dmarc-spf-dkim-2026-email-authentication-regulatory-requirement-best-practice/) - [ ![Email Monitoring Tools](https://media.mailhop.org/duocircle/images/2026/05/spf-validator-6720.jpg) Email Monitoring Tools: A Complete Guide to Protecting Your Email Ecosystem Email Security ](/blog/email-monitoring-tools-guide-protecting-your-email-ecosystem-security/) ## Related Articles [ Email Security 8m BIMI in 2026: What the Certificate Authority Does, and What Your DMARC Tool Does May 5, 2026 ](/blog/bimi-2026-what-the-ca-does-what-your-dmarc-tool-does/)[ Email Security 8m Designing A Custom Dkim Architecture For High-Volume Email Senders Apr 28, 2026 ](/blog/designing-custom-dkim-architecture-for-high-volume-email-senders/)[ Email Security 12m DMARC, SPF, and DKIM in 2026: Why Email Authentication Is Now a Regulatory Requirement, Not Just a Best Practice Apr 29, 2026 ](/blog/dmarc-spf-dkim-2026-email-authentication-regulatory-requirement-best-practice/)[ Email Security 5m Email Monitoring Tools: A Complete Guide to Protecting Your Email Ecosystem May 7, 2026 ](/blog/email-monitoring-tools-guide-protecting-your-email-ecosystem-security/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"That Employee You Want to Hire May be a Hacker","description":"You have to hand it to hackers. They’re always coming up with new ways to slip some malware passed unsuspecting email recipients.","url":"https://www.duocircle.com/blog/email-security/that-employee-you-want-to-hire-may-be-a-hacker/","datePublished":"2019-09-23T19:47:52.000Z","dateModified":"2025-04-25T12:33:47.000Z","dateCreated":"2019-09-23T19:47:52.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/that-employee-you-want-to-hire-may-be-a-hacker/"},"articleSection":"email-security","keywords":"","wordCount":254,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/09/windows-smtp-service-6247.jpg","caption":"Hacker","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Email Security"},{"@type":"ListItem","position":3,"name":"That Employee You Want to Hire May be a Hacker","item":"https://www.duocircle.com/blog/email-security/that-employee-you-want-to-hire-may-be-a-hacker/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Email Security","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"That Employee You Want to Hire May be a Hacker","item":"https://www.duocircle.com/blog/email-security/that-employee-you-want-to-hire-may-be-a-hacker/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"That Employee You Want to Hire May be a Hacker","description":"You have to hand it to hackers. They’re always coming up with new ways to slip some malware passed unsuspecting email recipients.","url":"https://www.duocircle.com/blog/email-security/that-employee-you-want-to-hire-may-be-a-hacker/","datePublished":"2019-09-23T19:47:52.000Z","dateModified":"2025-04-25T12:33:47.000Z","dateCreated":"2019-09-23T19:47:52.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/that-employee-you-want-to-hire-may-be-a-hacker/"},"articleSection":"email-security","keywords":"","wordCount":254,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/09/windows-smtp-service-6247.jpg","caption":"Hacker","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```