Could You Be the Next Target in a Phishing Campaign Hiding in Freelance Job Messages?

If you’ve ever opened a “quick Excel” from a new client because you didn’t want to look difficult, you’re not alone. The U.S. DOJ alleges a real campaign did exactly that at scale: 255 fake accounts used a freelance platform’s messaging system to send Excel files with malicious macros to roughly 80,000 freelancers between 2016 and 2017 . One click could pull down malware like TVRAT (TeamSpy/TVSPY) and DarkVNC, giving attackers remote control and a path to your logins and personal data . Let’s break down how this worked, what to watch for, and the practical habits that keep you out of the blast zone.

What the DOJ Says Happened (and Why Freelancers Were Perfect Targets)

Per the U.S. Department of Justice, this wasn’t a “spray and pray” spam blast. It was a repeatable system that used the normal rhythm of freelance work against people.

Here’s the alleged chain, simplified:

1. Create volume with fake identities. The DOJ says the defendant used 255 fake user accounts on an unnamed “freelance employment technology company” to look like real clients and keep messages flowing.
2. Deliver the payload inside the platform’s messaging. The Excel file didn’t come from a sketchy email address. It arrived where freelancers already negotiate scope, share files, and accept “test tasks.” That’s a big trust advantage for the attacker.
3. Use an Excel attachment with malicious macros. Between June 2016 and November 2017, those accounts allegedly sent Microsoft Excel attachments with malicious macros to about 80,000 freelancers.
4. One click triggers a download. The DOJ alleges the macros “downloaded malware from the Internet” onto victims’ systems—turning a “quick Excel” into an infection event.

The stakes were not theoretical. Court documents and DOJ statements (as summarized in reporting) say the campaign led to infections with TVRAT (TeamSpy/TVSPY) and DarkVNC, malware families associated with remote control and data theft.

And the victim pool was painfully relevant to U.S.-based freelancers: investigators found about half of infected victims were in the United States, with many in the Northern District of California.  That’s a reminder that “I’m too small to get targeted” is wishful thinking when attackers automate the targeting.

Why freelancers were perfect targets

Freelancers sit at the intersection of speed, trust, and file-sharing:

• You’re incentivized to respond fast. Miss the window and you miss the job.
• You’re conditioned to open client-provided files. Price sheets, briefs, sample data, invoices—Excel is normal.
• Your accounts are high-value. The DOJ says stolen data included e-commerce login credentials and personally identifiable information.
• Scale is built in. A single attacker can message thousands without tripping the “this feels weird” alarm until it’s too late.

The hard part is that none of this needs a sophisticated exploit. It needs a believable message, a plausible spreadsheet, and that one moment where you decide it’s easier to just open it.

The Trap: Why “Enable Content” Is the Moment Everything Goes Sideways

That “one moment” usually isn’t opening the file. It’s clicking “Enable Content” (or “Enable Editing”) when Excel throws a security warning.

Macros, in plain English

An Excel spreadsheet can contain more than numbers and formulas. It can also contain macros—little scripts that automate steps.

That’s handy when you wrote the file and trust it. It’s dangerous when the file came from a stranger in a job message.

When you hit Enable Content, you’re basically saying:

• “This document is allowed to run code on my computer.”
• “If the file wants to reach out to the internet, download something, or change settings… go ahead.”

That’s why macro-enabled phishing works so well. In the DOJ-described campaign, the Excel attachment’s malicious macros were the mechanism that helped kick off a download from the internet onto the target’s system.

The “unlock the doc” trick (and why it works on freelancers)

Attackers don’t need you to love macros. They just need you to feel slightly uncomfortable saying no.

Common freelancer-flavored setups look like:

• “Test task” spreadsheet: “Fill this out and send back in 30 minutes.”
• “Price list” or “requirements matrix”: “Enable content so the rates auto-calculate.”
• “Invoice template”: “Macros populate the fields—just click enable.”
• “Client dataset sample”: “Charts won’t show unless you enable editing.”

The psychological play is simple: speed + politeness + money on the line.

Why messaging-based delivery feels safe (but isn’t)

A file sent inside a freelance platform chat feels “internal,” like it’s already been screened. It also arrives in the same thread as normal work details, so your brain tags it as part of the job, not as a threat.

Attackers know that. They lean on “business as usual” to get you to override the one control Microsoft did put in your way: the macro warning.

Quick red flags before you click anything

Use this mental checklist the second you see an Excel attachment from a new or unverified client:

• Any pressure: “ASAP,” “last step before hire,” “urgent onboarding.”
• Any instruction to enable content to view, decrypt, or “fix” the sheet.
• Any mismatch between the job and the file (why does a logo design gig need a macro spreadsheet?).
• Any avoidance when you ask for a PDF, Google Sheet, or plain CSV instead.

If you’re staring at that yellow bar in Excel, treat it like a stop sign. It’s not being dramatic. It’s doing its job.

What Those Infections Actually Do: TVRAT + DarkVNC in Human Terms

Once you’ve clicked past the warning and the payload lands, the scary part isn’t some movie-style “hacker magic.” It’s boring. Practical. And that’s why it works.

According to the DOJ, victims were infected with TVRAT (also called TeamSpy/TVSPY) and DarkVNC—tools that gave the attacker remote control of the infected computer using familiar remote administration software. TVRAT provided access via TeamViewer, and DarkVNC via VNC Viewer.

What “remote control” really means for a freelancer

Remote access malware isn’t just about spying. It’s about acting as you.

If someone can control your machine remotely, they can:

• Open browsers and try to pull saved sessions, passwords, and autofill data
• Grab files from your Desktop/Downloads (where client docs usually live)
• Watch what you type or click while you work
• Pivot into other accounts you use on that same device (email, cloud storage, finance tools)

You don’t have to picture a genius attacker. Picture someone who can sit “behind” your keyboard for 10 minutes while you’re distracted.

How the data theft flow works (command-and-control in plain language)

The DOJ describes a common pattern: the malware sends stolen data from the victim computer to a command-and-control (C2) server, where it’s collected and then used for fraud or other criminal activity.

Think of C2 as the attacker’s home base:

• Your computer gets infected
• The malware “phones home” with data (and sometimes waits for instructions)
• The attacker pulls the stolen info from that server when convenient

The DOJ also noted infrastructure details that matter because they show planning: C2 domains paid for with virtual currency, and thousands of TVRAT-infected computers calling back to a C2 domain hosted in the United States.

What they were after

This wasn’t just about getting onto your laptop. The DOJ says the attacker also stole e-commerce login credentials and personally identifiable information (PII).

And once credentials are gone, cleanup stops being “delete the file.” It turns into account triage.

A Freelancer’s Practical Playbook: Safer Files, Safer Accounts, Less Damage

If remote access is the outcome, your goal is simple: make it hard to run anything, and make it less valuable if something slips through. This isn’t about being paranoid. It’s about building habits that don’t slow you down.

1) Safer files: keep “work files” from becoming “run code”

Your default stance: spreadsheets are for viewing, not executing.

• Never enable macros for a file you didn’t request and can’t verify.
• Ask for safer formats when possible:
• PDF for briefs and invoices
• CSV for raw data
• Google Sheets link (view-only) for simple tables
• Use viewer-only modes when you just need to read:
• Open Office docs in Protected View / preview where available
• If you can’t view safely, don’t “click around” to make it work

If you truly must open a stranger’s file

Treat it like you’re handling a lab sample.

• Open it in an isolated environment:
• a separate local user profile on your computer (work-only, no personal accounts logged in)
• a separate device reserved for client intake / downloads (best option if you can swing it)
• a virtual machine (VM) if you already know how to use one (don’t learn under pressure)
• Move slow for 60 seconds:
• Check the file extension (macro-enabled Excel often ends in .xlsm)
• Read the message for instructions like “enable content to view” (big red flag)
• If anything feels off, request a different format

2) Safer accounts: assume credentials can get exposed

If malware gets a foothold, it often turns into an account problem fast. Tighten these up now, not after an incident.

• Use a password manager so every account has a strong, different password
• Turn on MFA (authenticator app or security key beats SMS when available)
• Separate your worlds:
• one browser profile for freelance platforms + client tools
• one for personal email, banking, and shopping

• Keep your system boring:
• auto-updates on
• remove software you don’t use (remote tools, old plugins, random “PDF converters”)

3) Limit the blast radius of your contact info (this part is underrated)

A lot of scams don’t stop at malware. Once someone has your email/phone, you can get pulled into:

• reset-code attacks (“I’m sending you a code to verify you”)
• SIM-swap attempts and targeted social engineering
• endless spam that makes real client messages harder to spot

This is where Cloaked is genuinely useful for freelancers. You can create separate emails and phone numbers for client outreach and platform signups, then rotate or shut them off if one gets abused—without burning your real number or personal inbox.

4) If you already opened something suspicious

Don’t “wait and see.”

• Disconnect from the internet (Wi‑Fi off / unplug)
• Change passwords from a clean device
• Revoke sessions where you can (email, cloud storage, freelance platform logins)
• Run a reputable malware scan, and if you see signs of remote access, consider a full reinstall

Small habits beat heroics. The win is catching the problem at the file stage, before it turns into an identity and account recovery mess.

What Platforms Can Fix (Without Making Freelancers’ Lives Miserable)

Freelancers can do a lot on their side, but platforms control the “blast radius.” If a marketplace lets brand-new accounts send attachments at scale, attackers will keep treating it like a delivery system.

The DOJ-described case had a clear signal a platform could detect early: many fake accounts used to message at high volume. Reporting on the case cites 255 fake user accounts pushing malicious Excel attachments.

Platform controls that stop attachment-based phishing without killing workflow

1. Treat macro files like loaded weapons

Macro malware is a known pattern. Platforms don’t need to guess intent.

• Block macro-enabled Office files by default in messaging (ex: .xlsm, macro-enabled .docm)
• If blocking is too aggressive, quarantine and force a review flow:
• hold the file
• scan it
• add friction before it reaches inboxes

2. Scan attachments like email providers do

Messaging isn’t “safer” than email if it allows file delivery.

• Inline malware scanning on upload + on download
• Detonate suspicious attachments in a sandbox (open it safely and watch what it tries to do)
• Strip active content when possible (or convert Office docs to safe previews)

3. Add “first-contact” guardrails where scams start

Most damage happens before trust is established.

• Warning banner on first-time messages: “New contact. Be careful with attachments.”
• Disable attachments until basic trust signals exist, like:
• verified identity
• a funded contract milestone
• account age + history thresholds

4. Rate-limit behavior that only scammers need

High-volume outreach is normal for spam, not normal for real hiring.

• Throttle new-account messaging (per hour/day)
• Limit identical messages sent to many recipients (template spam patterns)
• Detect burst attachment sending (a strong phishing indicator)

Incident response basics platforms should have ready

When a campaign starts, speed matters more than perfect attribution.

• One-click reporting inside chat (“Report phishing” on message + attachment)
• Fast takedown of accounts and file hashes once confirmed malicious
• User notifications to everyone who received the file (clear, blunt instructions)
• Logging + pattern detection to surface clusters:
• many accounts sharing similar send behavior
• many recipients receiving the same attachment type
• abnormal spikes that mirror the “255 accounts” scale mentioned in the DOJ reporting

Platforms don’t have to make freelancing harder. They just need to stop treating their messaging system like a neutral pipe for executable content.

‍