Know What's Happening in Cybersecurity

Threat Actors Exploit LinkedIn for RAT Delivery in Enterprise Networks

A new phishing campaign is using LinkedIn private messages to deliver remote access trojans to enterprise networks. Attackers send self‑extracting WinRAR archives that contain a legitimate PDF reader, a malicious DLL, and a portable Python interpreter. The DLL is loaded via sideloading, while the Python script runs Base64‑encoded shellcode in memory, creating a persistent Run‑key RAT that evades traditional AV. Precise LinkedIn targeting and trusted tools let the campaign bypass email security and reach high‑value employees.