Cybersecurity researchers have uncovered a new phishing campaign abusing social media private messages, particularly LinkedIn, to distribute malware and establish persistent remote access on victim systems.
🔍 How the attack works
Attackers impersonate trusted contacts and engage targets via LinkedIn direct messages. Victims are tricked into downloading a malicious WinRAR self-extracting archive (SFX) that contains:
📄 A legitimate open-source PDF reader
🧩 A malicious DLL that is side-loaded by the PDF reader
🐍 A portable Python interpreter
📦 A decoy RAR file
Once the PDF reader is launched, the rogue DLL is side-loaded, dropping Python onto the system and creating a registry Run key for persistence. The Python interpreter executes Base64-encoded shellcode directly in memory, avoiding disk-based detection.
🛠 Why this is effective
- DLL side-loading hides malicious activity behind legitimate software
- Open-source tools reduce suspicion and evade security controls
- Social media DMs are far less monitored than email
📡 Post-exploitation
The final payload connects to an external server, enabling:
- Persistent remote access (RAT-like behavior)
- Data exfiltration
- Potential lateral movement and privilege escalation
🚨 Researchers have linked similar techniques to recent campaigns delivering LOTUSLITE, PDFSIDER, and other commodity trojans and info-stealers.
⚠️ Key takeaway
Social media platforms have become a critical attack surface. Unlike email, private messages often lack enterprise-grade security monitoring, making them ideal for stealthy initial access.
Organizations should:
✔ Treat social media as a first-class attack vector
✔ Train users to distrust unsolicited files and archives
✔ Monitor endpoint behavior, not just email gateways
