LinkedIn DMs abused to spread Python-based malware

ReliaQuest has detailed a phishing campaign that uses social media private messages to distribute a malicious archive and run an open-source Python penetration-testing script as part of an infection chain.

The company said the activity relied on direct messages on and combined several established techniques with a tool it had not seen used in comparable attacks.

"Central to this campaign is an unusual tactic: the execution of an open-source, Python pen-testing script that our team had not observed in similar attacks before," said The ReliaQuest Threat Research team.

The campaign started with a phishing message delivered through private messages. The message directed recipients to download a WinRAR self-extracting archive.

ReliaQuest said the attackers used 's professional setting to build trust with targets in corporate environments. The company described the targets as high-value individuals and said the same approach could work on other platforms accessed on business devices.

ReliaQuest also framed the incident as part of a wider shift in how phishing attempts reach staff. The company said organisations often focus their controls on email and leave gaps around messaging apps, engines, and social platforms.

"This campaign serves as a reminder that phishing isn't confined to email inboxes. Phishing attacks take place over alternative channels like social media, engines, and messaging apps-platforms that many organizations still overlook in their security strategies," said The ReliaQuest Threat Research team.

ReliaQuest said the self-extracting archive unpacked multiple components. These included a legitimate PDF reader application, a malicious Dynamic Link Library file, a portable executable of a Python interpreter, and a RAR file that ReliaQuest said likely acted as a decoy.

The company said the attackers tailored filenames to recipients' roles or industries. It gave examples such as "Upcoming_Products.pdf" and "Project_Execution_Plan.exe". ReliaQuest said this technique aimed to raise the likelihood that a recipient would open the file.

ReliaQuest said the attack chain used DLL sideloading after the victim opened the extracted PDF reader. The technique places a malicious DLL in the same directory as a legitimate application. ReliaQuest said the application loaded the local DLL before checking the system directory.

ReliaQuest said the attacker's code then ran under the PDF reader's process. The company linked this to evasion from endpoint security tooling and to activity that can appear consistent with legitimate application behaviour.

After the DLL executed, ReliaQuest said it dropped a Python interpreter onto the system and created a persistent registry Run key. The company said this Run key included embedded Python code.

ReliaQuest said the interpreter executed an open-source shellcode runner script encoded in Base64. It said the script decoded in memory using Python's exec() function. The company said this reduced disk artefacts.

ReliaQuest said it observed command-and-control activity during analysis. It described frequent attempts to a command-and-control server. The company associated that behaviour with remote access trojans.

ReliaQuest said the operation showed how attackers use legitimate tools and widely available code. It said the use of an open-source Python penetration-testing script reduced the need for custom malware development.

It also said open-source tools can complicate attribution. ReliaQuest said the attacker used the script directly from its public repository without modifications.

ReliaQuest placed the campaign alongside other social media-based delivery efforts that have distributed remote access trojans and backdoors. It referenced financially motivated groups FIN6 and Cobalt Group and their use of social media spearphishing to distribute the "More_eggs" backdoor. It also referenced North Korean group Lazarus and "Operation Dangerous Password" also known as "CryptoCore".

ReliaQuest said social platforms provide reconnaissance opportunities through public job titles and role descriptions. It said this information can guide targeting and message crafting, including naming files in ways that appear relevant to a recipient's work.

The company said organisations should treat social media as part of their attack surface and review how staff access these platforms on corporate devices. ReliaQuest said social media platforms would likely see increased targeting over the 12-24 months.