Threat Actors Leverage LinkedIn Messaging To Deliver Sophisticated Malware

A newly observed phishing campaign is exploiting professional networking messages on to deliver stealthy malware capable of establishing persistent remote access on compromised machines, according to independent cybersecurity researchers. The operation underscores a growing trend in which attackers blend social engineering with advanced execution techniques to bypass conventional defences and escalate into corporate networks.

According to a technical analysis by ReliaQuest , attackers initiate with “high-value” targets through private messages crafted to establish rapport before baiting recipients into downloading a malicious compressed archive. Once executed by an unsuspecting user, the package unpacks multiple components: a legitimate PDF reader application, a tainted Dynamic Link Library (DLL), a portable Python interpreter executable, and a decoy RAR-format file.

Once the victim launches the PDF reader, the malicious DLL triggers two key actions: it installs the Python interpreter and writes a Windows Registry Run key that ensures the interpreter executes at every system login. The interpreter decodes and runs Base64-encoded shellcode directly in memory, avoiding creation of disk artifacts and aiding in persistence. Network traffic observed during analysis indicates attempts to communicate with external command-and-control infrastructure — behaviour consistent with remote access trojans (RATs) that give operators covert access to infected systems.

Threat actors identify high-value targets (employees, recruiters, engineers, executives) on . Attackers initiate using professional pretexts such as collaboration requests, documents, job discussions, or business proposals. Trust is built through brief conversation, mimicking legitimate networking behavior.

Victims are persuaded to download a WinRAR self-extracting archive (SFX) sent via messages. The archive appears legitimate and business-related, reducing suspicion. Because the delivery occurs via DMs, it bypasses traditional email security gateways.

When the archive is executed, it extracts multiple components:

A legitimate open-source PDF reader A malicious DLL crafted for sideloading A portable Python interpreter A decoy RAR file to distract or reassure the victim

The victim launches the PDF reader. Windows loads the malicious DLL instead of a legitimate one, because it resides in the same directory. The malicious code runs under the guise of a trusted application, evading signature-based detection.

The malicious DLL drops the Python interpreter onto the system. A Windows Registry Run key is created, ensuring execution on every login. This grants attackers long-term access even after reboots.

Python decodes and executes Base64-encoded shellcode directly in memory. No executable payload is written to disk, reducing forensic evidence. Endpoint solutions relying on file-based scanning may fail to detect activity.

The malware connects to an external attacker-controlled server.

Attackers gain remote access , enabling:

Data exfiltration Credential harvesting Lateral movement within corporate networks Privilege escalation

Extend security policies beyond email to include , Slack, Teams, and other messaging platforms. Educate employees that business messages can be weaponized, even on trusted professional networks. Prohibit downloading or executing files received via social media without verification.

Enable behavior-based detection for:

DLL sideloading and hijacking Legitimate applications loading unsigned or unexpected DLLs Registry Run key creation tied to scripting engines

Monitor execution of portable interpreters (Python, PowerShell, Node.js) outside approved paths.

Enforce DLL order hardening and safe DLL loading practices where possible. Use application control / allow-listing to restrict which binaries can execute. Block execution of applications from user-writable directories such as Downloads or Temp.

Deploy tools capable of memory scanning and runtime analysis, not just file inspection. Monitor suspicious Base64 decoding, shellcode injection, and reflective loading patterns. Log anomalous parent-child process relationships (e.g., PDF reader → Python interpreter).

Inspect outbound connections for unusual or newly registered domains . Segment networks to prevent lateral movement from a single compromised endpoint. Enforce least-privilege access and multi-factor authentication (MFA) across all systems.

Train employees to recognize:

Unexpected file requests over Pressure tactics or urgency in professional messages Requests to open “documents,” “archives,” or “assessments”

Encourage reporting of suspicious social media interactions to security teams.

Update playbooks to include social-media-borne intrusions. Ensure logs from endpoints, identity systems, and network traffic are centrally correlated. Practice tabletop exercises involving DLL sideloading and fileless malware scenarios.

This -centric campaign highlights the expanding threat surface posed by social media platforms, which traditionally have not been afforded the same monitoring and filtering controls as email systems.

This is not an isolated trend. Cyber threat intelligence firms have reported multiple concurrent campaigns leveraging DLL sideloading for RAT and stealer distribution, including malware families such as PDFSIDER, LOTUSLITE and commodity trojans delivered via spear phishing and malicious archives.

Recent reporting also reveals a surge in side-loading abuse through signed open-source binaries — such as components of the c-ares library — to launch hidden payloads without triggering signature-based defences.

The -messaging technique parallels other recent lateral movements by adversaries targeting corporate and enterprise networks. Groups such as “Silver Fox” have been documented using phishing lures themed around income tax compliance to deliver ValleyRAT, another modular RAT family, leveraging DLL hijacking to persist quietly on infected hosts.

Additionally, broader phishing campaigns continue to use fake AI-generation adverts on social networks to spread malware, illustrating the ongoing exploitation of social channels beyond direct messaging. Researchers have linked such campaigns to threat actor UNC6032, which promotes phony tools that install reconnaissance and backdoor payloads when users engage with malicious ads.

This campaign demonstrates a mature evolution of phishing : blending trusted platforms, legitimate open-source software, and stealthy execution techniques. Organizations that continue to focus solely on email security risk missing the earliest—and most critical—stage of compromise.

Social media is now a critical attack surface requiring dedicated monitoring and policy controls. Traditional defences focused on email filtering and web gateways may not adequately detect or block messages sent through direct messaging features of professional platforms, leaving organisations blind to early stages of advanced attacks.

Recommended mitigation measures include strengthening endpoint detection to recognise suspicious loader behaviours, enforcing strict application whitelisting, and extending security awareness training to include threats received through social channels. Network telemetry and behaviour-based detection systems can also help flag anomalous processes launched via trusted binaries — a key indicator of sideloading abuse.

Organisations should adopt a zero-trust stance , logging and validating all inbound connections regardless of origin, and segmenting network access to limit lateral movement even if an initial endpoint is compromised.

This FREE tool below lets you use your own environment data to see exactly what Identity Dark Matter is costing you today and how much time you can reclaim through total observability 👇🏻