Cybersecurity News and Headlines

PDFSIDER Malware Actively Exploited to Evade Antivirus and EDR Defenses

Researchers have uncovered PDFSIDER, a backdoor malware that exploits DLL side‑loading in the legitimate PDF24 Creator application to evade endpoint detection and response tools. The malicious payload is delivered via spear‑phishing ZIP archives, signed with valid certificates, and replaces the authentic cryptbase.dll with a malicious version. PDFSIDER operates primarily in memory, encrypts its command‑and‑control traffic with AES‑256‑GCM, and tunnels data through DNS port 53 to hide communications. The malware includes sandbox‑evasion checks, terminating on low‑memory or virtual environments.