Hackers Use LinkedIn Messages to Spread RAT Malware Through DLL Sideloading

Cybersecurity researchers have uncovered a sophisticated phishing campaign that uses LinkedIn private messages to propagate malware, targeting high-value individuals with a multi-stage attack that leverages DLL sideloading and open-source tools. The campaign, documented by ReliaQuest, demonstrates how threat actors are shifting from traditional email-based attacks to social media platforms that often lack the same level of security monitoring.

The Attack Chain: Trust Exploitation and Technical Evasion

The attack begins with threat actors approaching targets through LinkedIn direct messages, establishing a veneer of professional trust before deceiving them into downloading a malicious WinRAR self-extracting archive (SFX). This archive contains four distinct components that work in concert to bypass security controls:

1. Legitimate PDF Reader Application: A genuine, signed PDF reader executable that serves as the initial loader
2. Malicious DLL: A rogue dynamic link library that will be sideloaded by the legitimate PDF reader
3. Portable Python Interpreter: A standalone PE file that executes the final payload
4. Decoy RAR File: Likely containing benign documents to maintain the illusion of legitimacy

When the victim launches the PDF reader, the malicious DLL gets sideloaded through a Windows DLL search order hijacking vulnerability. This technique has become increasingly popular among threat actors because it allows malware to execute within the context of a trusted, signed process, making it difficult for traditional antivirus solutions to detect the malicious activity.

From Sideloading to Memory-Resident Payloads

Once the DLL is sideloaded, it performs several critical functions. First, it drops the portable Python interpreter onto the system and creates a Windows Registry Run key to ensure persistence across reboots. The Python interpreter then executes a Base64-encoded shellcode directly in memory, a technique specifically designed to avoid leaving forensic artifacts on disk.

This memory-resident approach represents a significant evolution from traditional malware delivery methods. By executing entirely in RAM, the payload can evade file-based detection mechanisms and traditional endpoint protection platforms that rely on scanning files at rest. The final payload establishes communication with an external command-and-control server, granting attackers persistent remote access and the ability to exfiltrate sensitive data.

The Broader Trend: DLL Sideloading as an Evasion Tactic

The ReliaQuest campaign is part of a larger pattern of DLL sideloading abuse. Over the past week alone, at least three documented campaigns have leveraged this technique to deliver malware families including LOTUSLITE and PDFSIDER, along with various commodity trojans and information stealers.

DLL sideloading works by exploiting how Windows searches for dynamic link libraries. When an application loads a DLL, Windows checks several locations in a specific order: the application's directory, system directories, the current working directory, and finally the system PATH. By placing a malicious DLL with the same name as a legitimate one in an earlier-searched location, attackers can force the application to load their code instead of the intended library.

This technique provides several advantages for attackers:

• Process Legitimacy: The malware runs within a signed, trusted process
• Reduced Detection: Security tools often whitelist legitimate applications
• Persistence: The sideloading mechanism can be triggered repeatedly
• Evasion: Fileless execution patterns bypass traditional scanning

Social Media as an Untapped Attack Surface

What makes this campaign particularly concerning is its delivery mechanism. Unlike email, which most organizations monitor with sophisticated security tools, LinkedIn messages typically receive minimal scrutiny. As ReliaQuest noted, "Social media platforms commonly used by businesses represent a gap in most organizations' security posture."

This isn't the first time LinkedIn has been weaponized for targeted attacks. North Korean threat actors have previously used the platform under the guise of job opportunities, convincing victims to run malicious code as part of supposed technical assessments. In March 2025, Cofense documented a campaign using LinkedIn InMail notifications to trick users into downloading ConnectWise remote desktop software.

The shift toward social media platforms represents a strategic evolution in phishing tactics. Attackers recognize that corporate email security has matured significantly, with advanced filtering, sandboxing, and user training programs. Social media platforms, by contrast, often lack these controls and benefit from the inherent trust users place in professional networking sites.

Practical Defensive Recommendations

Organizations seeking to protect against this and similar campaigns should implement a multi-layered defense strategy:

1. Extend Security Monitoring Beyond Email Deploy security tools that can monitor and analyze social media communications, particularly LinkedIn messages. Consider implementing Data Loss Prevention (DLP) solutions that can inspect file transfers from social media platforms.

2. Implement Application Whitelisting Use application control solutions to restrict which executables can run on endpoints. This prevents unauthorized applications, including legitimate ones being used for sideloading, from executing without explicit approval.

3. Monitor DLL Loading Behavior Deploy endpoint detection and response (EDR) solutions that can detect anomalous DLL loading patterns. Look for applications loading DLLs from unusual locations or with suspicious signatures.

4. Restrict Python Execution Since the campaign uses a portable Python interpreter, consider implementing application control policies that restrict Python execution to authorized users and locations. Monitor for Python processes making network connections to external servers.

5. User Education and Awareness Train employees to be skeptical of unsolicited LinkedIn messages, especially those requesting file downloads or software execution. Establish clear policies for handling professional communications that involve file transfers.

6. Registry Monitoring Implement monitoring for suspicious Registry modifications, particularly Run keys that establish persistence mechanisms. The campaign's use of Registry Run keys is a common persistence technique that should be flagged.

7. Network Traffic Analysis Monitor outbound network connections for suspicious patterns, particularly from applications that don't typically initiate external connections. The final payload's communication with command-and-control servers should be detected and blocked.

The Future of Social Media-Based Attacks

This campaign illustrates a broader trend in cybersecurity: attackers are constantly seeking new avenues to bypass established defenses. As organizations improve their email security posture, threat actors naturally migrate to less-defended channels.

Social media platforms present a unique challenge because they blend personal and professional communications. Employees often use LinkedIn for legitimate business purposes, making it difficult to implement blanket blocking policies without disrupting legitimate work activities.

The use of legitimate open-source tools further complicates detection. Security tools must distinguish between authorized use of tools like Python and malicious use, requiring more sophisticated behavioral analysis rather than simple signature-based detection.

Conclusion

The LinkedIn-based DLL sideloading campaign represents a sophisticated evolution in phishing tactics that combines social engineering with advanced technical evasion techniques. By exploiting trust in professional networking platforms and leveraging legitimate applications for malicious purposes, attackers have created a potent delivery mechanism that bypasses many traditional security controls.

Organizations must recognize that their attack surface extends beyond email and web browsers to include social media platforms, messaging applications, and other communication channels. Implementing comprehensive security monitoring, application control, and user education programs is essential for defending against these evolving threats.

For security teams, this campaign serves as a reminder that the most effective defenses are layered and adaptive, capable of detecting not just known malware signatures but also anomalous behavior patterns that indicate compromise, regardless of the delivery mechanism used.

---

Related Resources:

• ReliaQuest Threat Intelligence for ongoing threat analysis
• Microsoft Security Intelligence for guidance on DLL sideloading detection
• CISA Alert on Social Engineering for broader threat context