Operation Hanoi Thief: Hackers Use ‘Pseudo-Polyglot’ LNK/Image to Deploy LOTUSHARVEST Stealer via DLL Sideloading

Operation Hanoi Thief is a sophisticated cyber-espionage campaign targeting Vietnam's technology and recruitment sectors, discovered by SEQRITE Labs on November 3, 2025. The campaign uses spear-phishing tactics, starting with a malicious email containing a ZIP file disguised as a job application. Inside, it includes a pseudo-polyglot payload that combines a resume image, a PDF document, and a malicious batch script.

When the victim opens the LNK file, it triggers a command execution that leads to the installation of LOTUSHARVEST, a C++ information stealer. This malware extracts sensitive data from browsers like Google Chrome and Microsoft Edge, including browsing history and credentials, which are then exfiltrated to attacker-controlled domains. The attackers' identity remains unconfirmed, but evidence suggests a possible connection to a Chinese-origin threat actor.