Hackers Use LinkedIn Messages to Spread RAT Malware Through DLL Sideloading

A new phishing campaign uses LinkedIn private messages to approach high‑value individuals, persuading them to download a malicious WinRAR self‑extracting archive that delivers weaponised files via DLL sideloading. The archive unpacks four components, including a legitimate open‑source PDF reader, a malicious DLL sideloaded by the PDF reader, a portable executable of the Python interpreter, and a decoy RAR file.

When the PDF reader runs, the rogue DLL is sideloaded to activate the infection chain, with the Python interpreter then executing a Base64‑encoded open‑source shellcode in memory to avoid leaving forensic artefacts on disk. The final payload communicates with an external server to grant attackers persistent remote access and exfiltrate data.

ReliaQuest said the campaign appears broad and opportunistic across sectors and regions, noting that because it plays out in direct messages on social platforms, quantifying the full scale is difficult, according to ReliaQuest.