ValleyRAT Targets English Job Seekers by Trojanizing Foxit PDF Reader with DLL Sideloading

ValleyRAT is being used in a campaign that targets English-speaking job seekers and human resources professionals, according to Trend Micro. The attack leverages weaponized versions of Foxit PDF Reader and uses DLL sideloading to deliver the malware, with the malicious executable masquerading as a legitimate PDF. The infection chain begins with a spear-phishing email containing a malicious archive, often named enticingly as Overview_of_Work_Expectations.zip or Authentic_Job_Application_Form.zip.

Inside, victims find a file named Compensation_Benefits_Commission.exe, which uses the Foxit logo as its icon to look trustworthy. When executed, the renamed FoxitPDFReader.exe loads a malicious DLL named msimg32.dll from the same folder, taking advantage of Windows’ preference for local files to load the malware.

Once footholds are established, ValleyRAT functions as a remote access Trojan capable of monitoring activity, stealing data, and potentially loading additional plugins, indicating a multi-stage, evasive approach. The campaign marks a shift from Chinese-speaking targets to English-language filenames and job-related lures, expanding its opportunistic reach. December 8, 2025.