Threat Actors Leveraging Foxit PDF Reader to Gain System Control and Steal Sensitive Data

The report describes the ValleyRAT campaign that targets job seekers with fake recruitment archives containing a disguised Foxit executable which abuses DLL side-loading (msimg32.dll), a bundled Python environment, and shellcode to deploy a remote access trojan that persists via registry entries and steals browser credentials and other sensitive data.