Hackers Employ DLL Side-Loading To Deliver Malicious Python Code

A recent campaign observed by Internet Storm Center leverages DLL side-loading to deploy malicious DLLs that decrypt and execute embedded Python code in memory. Attackers use spear-phishing attachments to launch legitimate applications that load the malicious DLL first, enabling fileless execution, credential harvesting, lateral movement, and persistent C2 communication; the activity targets financial and healthcare organizations and employs XOR obfuscation and legitimate Python libraries to evade detection.