New Phishing Campaign Exploits LinkedIn Direct Messages to Deploy Remote Access Trojans

Cybercriminals have turned their sights toward LinkedIn, abandoning traditional email phishing methods in favor of a sophisticated social engineering campaign that targets high-level professionals through private direct messages. A new report from the ReliaQuest Threat Research unit details how attackers are manipulating the inherent trust of professional networking to bypass corporate security filters and deliver malware capable of total system compromise.

The investigation, led by researcher Emily Jia, outlines a distinct shift in tactics where hackers prioritize relationship-building over "spray and pray" email blasts. Rather than immediately sending a malicious link, the threat actors engage targets in extended conversations to establish a rapport. Once a sense of professional trust is secured, the attacker persuades the victim to download a WinRAR self-extracting archive. These files are deliberately named to mimic routine business assets, such as “Project_Execution_Plan.exe” or “Upcoming_Products.pdf,” ensuring they raise little suspicion within a corporate environment.

While the delivery method relies on psychology, the technical execution utilizes a clever mechanism known as DLL side-loading. The downloaded archive contains a bundle of four files: a legitimate PDF reader, a hidden Dynamic Link Library (DLL) file, a portable version of the coding language Python, and a decoy RAR file. When the user opens the seemingly harmless PDF reader, it automatically loads the malicious DLL file stored in the same folder. This action triggers the Python interpreter—a tool generally trusted by security software—to execute a script that installs a Remote Access Trojan (RAT). This allows the attacker to steal sensitive data or covertly monitor the user’s screen without triggering standard antivirus alarms.

This campaign represents a growing trend of "living off the land," where hackers weaponize legitimate software to hide their activities. Recent weeks have seen similar exploits, including the discovery of the PDFSIDER backdoor targeting a Fortune 100 company and the LOTUSLITE malware found hidden inside a music player application. These incidents highlight a widespread move toward manipulating open-source tools that corporate networks cannot easily block.

Jason Soroko, a Senior Fellow at Sectigo, emphasizes that the danger lies in the combination of technical loopholes and social manipulation. He notes that the innovation here is not the code itself, but the specific targeting of professional relationships to lower a victim's guard. Because social media platforms like LinkedIn lack the aggressive threat detection filters found in enterprise email servers, they have become a blind spot for businesses. Security experts are now urging professionals to exercise extreme caution with file transfers, even when dealing with contacts who appear to have legitimate profiles.