Suspected Iranian hackers have been spreading malware through fake job offers that fool targets into downloading a malicious ZIP file, according to a cybersecurity firm.

"The campaign distributed the SnailResin malware, which activates the SlugResin backdoor," Israeli cybersecurity company ClearSky said in a Tuesday analysis. TA455, also tracked by Google-owned Mandiant as UNC1549 and Yellow Dev 13,