Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware

Security experts have disclosed an active malware campaign that exploits a DLL side-loading vulnerability in a legitimate binary linked to the open‑source c-ares library to bypass security controls and deploy a range of trojans and stealers. Attackers achieve evasion by pairing a malicious libcares-2.dll with any signed version of the legitimate ahost.exe (often renamed) to execute their code, a DLL side-loading technique that can bypass traditional signature-based protections, according to Trellix.

The campaign has been seen distributing malware such as Agent Tesla, CryptBot, Formbook, Lumma Stealer, Vidar Stealer, Remcos RAT, Quasar RAT, DCRat and XWorm. Targets include employees in finance, procurement, supply chain and administration within commercial and industrial sectors like oil and gas, with lures written in Arabic, Spanish, Portuguese, Farsi and English, suggesting regional specificity.

The attackers place a malicious version of the DLL in the same directory as the vulnerable binary, taking advantage of search order hijacking to run the rogue DLL instead of the legitimate one, with ahost.exe signed by GitKraken and typically distributed as part of its Desktop application.