SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats

According to Trellix researchers Ernesto Fernández Provecho and Pham Duy Phuc, SideWinder has launched a new campaign against a European embassy in New Delhi and several organisations in Sri Lanka, Pakistan, and Bangladesh, with activity observed in September 2025 and attributed to a threat actor known as SideWinder.

The campaign marks an evolution in SideWinder’s techniques, introducing a novel PDF and ClickOnce-based infection chain alongside earlier Microsoft Word exploits, and involves four waves of spear-phishing from March to September 2025 designed to drop ModuleInstaller and StealerBot on compromised hosts.

The attackers use a decoy PDF that prompts the victim to download and install the latest version of Adobe Reader, which triggers a ClickOnce download from a remote server and sideloads a malicious DLL called DEVOBJ.dll, while a legitimate-looking MagTek ReaderConfiguration.exe masquerades as Adobe Reader.

The StealerBot payload, which is a .NET implant, can launch a reverse shell, collect credentials and files, and the downloader ModuleInstaller fetches next-stage payloads; communications with the C2 are region-locked to South Asia and payloads are downloaded from dynamically generated paths.

Trellix notes that the attacks leverage custom malware and side-loading of legitimate applications to evade defenses, with previous public documentation of ModuleInstaller and StealerBot by Kaspersky in October 2024, and Acronis revealing SideWinder’s South Asian government-targeted activity in May 2025.