Attackers Leverages LinkedIn to Deliver Remote Access Trojan Targeting Corporate Environments

A sophisticated LinkedIn phishing campaign delivers weaponized WinRAR self-extracting archives tailored to recipients, which sideload a malicious DLL into a trusted PDF reader process, deploy an in-memory Python payload (via Base64-encoded shellcode runner), and establish persistence with a registry Run key—enabling remote access, lateral movement, and data theft; ReliaQuest investigators reported rapid, multi-stage execution and notable evasion techniques.