DLL Sideloading Archives • Page 2 of 5 • Daily CyberSecurity

Twill Typhoon RAT Campaign Uses DLL Side Loading to Target APJ Networks

Twill Typhoon RAT campaign DLL side loading tradecraft

Twill Typhoon RAT Campaign Uses DLL Side Loading to Target APJ Networks

Do Son June 2, 2026

A stealthy Twill Typhoon RAT campaign targets APJ organizations. Discover how this threat exploits DLL side loading tradecraft to evade security.

Legitimate Software Abused: Stealthy ValleyRAT Malware Campaign Targets Enterprise Users

Do Son May 24, 2026

A sophisticated ValleyRAT malware campaign uses fake Microsoft Teams installers and DLL sideloading to evade Windows Defender detection.

Twill Typhoon Exploits CDN Masquerading and DLL Sideloading to Breach APJ Networks Twill Typhoon DLL Sideloading

Twill Typhoon Exploits CDN Masquerading and DLL Sideloading to Breach APJ Networks

Do Son May 22, 2026

Darktrace exposes Chinese APT Twill Typhoon’s latest campaign using DLL sideloading and Yahoo/Apple CDN lookalikes to deploy a modular .NET RAT.

Chinese APT FamousSparrow Weaponizes Evolved Deed RAT Against Azerbaijani Energy Infrastructure FamousSparrow Deed RAT ProxyNotShell Exchange Exploitation

FamousSparrow Deed RAT ProxyNotShell Exchange Exploitation

Chinese APT FamousSparrow Weaponizes Evolved Deed RAT Against Azerbaijani Energy Infrastructure

Do Son May 19, 2026

Bitdefender exposes a persistent FamousSparrow campaign using advanced DLL sideloading and Deed RAT to compromise energy infrastructure. Patch now!

Stealth & Automation: Seedworm’s 2026 Global Campaign Hijacks Security Software to Deploy ChromElevator Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Stealth & Automation: Seedworm’s 2026 Global Campaign Hijacks Security Software to Deploy ChromElevator

Do Son May 15, 2026

Iranian group Seedworm infiltrates global firms using automated Node.js scripts and DLL sideloading via trusted binaries. Protect your credentials now!

“Lorem Ipsum” Loader Weaponizing Microsoft Teams via SEO Poisoning Lorem Ipsum Malware Microsoft Teams SEO Poisoning

“Lorem Ipsum” Loader Weaponizing Microsoft Teams via SEO Poisoning

Do Son May 12, 2026

BlueVoyant unmasks "Lorem Ipsum": a well-funded campaign using SEO poisoning and signed MS Teams installers to deploy stealthy backdoors via image files.

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits SHADOW-EARTH-053 ShadowPad Espionage

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits

Do Son May 5, 2026

SHADOW-EARTH-053 is breaching governments and NATO using old ProxyLogon flaws and ShadowPad. Learn how this China-aligned group stays hidden via registry loading.

The Lotus Evolves: Mustang Panda Targets Indian Banks in a New Espionage Pivot Mustang Panda LOTUSLITE Financial Cyber-Espionage

The Lotus Evolves: Mustang Panda Targets Indian Banks in a New Espionage Pivot

Do Son April 23, 2026

Mustang Panda targets India’s financial sector with the LOTUSLITE malware. Learn how this DLL sideloading campaign bypasses defenses for cyber-espionage.

JanelaRAT Uses Fake Windows Updates to Empty LATAM Bank Accounts JanelaRAT LATAM Banking Malware

JanelaRAT Uses Fake Windows Updates to Empty LATAM Bank Accounts

Do Son April 15, 2026

JanelaRAT targets banking users in Brazil and Mexico using window monitoring and fake updates. Learn how this 2026 threat bypasses MFA to hijack sessions.

The CPUID Watering Hole Attack Turning CPU-Z into a Trojan CVE-2023-22952 CPUID Watering Hole DLL Sideloading

The CPUID Watering Hole Attack Turning CPU-Z into a Trojan

Do Son April 13, 2026

April 2026 Alert: CPUID downloads for CPU-Z and HWMonitor were poisoned with STX RAT via DLL sideloading. Check your systems for CRYPTBASE.dll now!

LinkedIn Job Seekers Targeted by Sophisticated “PXA Stealer” Campaign PXA Stealer LinkedIn Job Phishing

LinkedIn Job Seekers Targeted by Sophisticated “PXA Stealer” Campaign

Do Son April 10, 2026

LinkedIn job seekers are being targeted by a sophisticated Vietnam-based group using PXA Stealer. This 100MB malware bypasses MFA and drains crypto wallets.

Blitz Brigantine Weaponizes Email Bombing and DNS MX Records to Deploy AOBackdoor Cemu emulator Linux malware Blitz Brigantine AOBackdoor GitHub Malware Campaign StealC Infostealer TamperedChef Malware, SEO Poisoning Carbanak malware RubyGems Supply Chain, Infostealer

Cemu emulator Linux malware Blitz Brigantine AOBackdoor GitHub Malware Campaign StealC Infostealer TamperedChef Malware, SEO Poisoning Carbanak malware RubyGems Supply Chain, Infostealer

Blitz Brigantine Weaponizes Email Bombing and DNS MX Records to Deploy AOBackdoor

Do Son March 16, 2026

BlueVoyant exposes Blitz Brigantine's new tactics: using email bombing, Microsoft Teams lures, and covert DNS MX tunneling to deploy AOBackdoor.

The High Cost of ‘Free’: How PiviGames Became a Lovecraftian Malware Hub for HijackLoader and ACRStealer Lotus Wiper Digital Sabotage G_Wagon Malware NPM Supply Chain Attack IMAPLoader malware ResolverRAT Malware Evasion

Lotus Wiper Digital Sabotage G_Wagon Malware NPM Supply Chain Attack IMAPLoader malware ResolverRAT Malware Evasion

The High Cost of ‘Free’: How PiviGames Became a Lovecraftian Malware Hub for HijackLoader and ACRStealer

Do Son March 3, 2026

G DATA reveals how pirated gaming site PiviGames distributes ACRStealer via "spaghetti code" HijackLoader and DLL sideloading, causing total account takeovers.

Dohdoor: New Stealth Backdoor Targets US Healthcare and Education Dohdoor Backdoor UAT-10027

Dohdoor: New Stealth Backdoor Targets US Healthcare and Education

Do Son March 2, 2026

Cisco Talos uncovers "Dohdoor," a stealthy backdoor used by UAT-10027. It abuses DNS-over-HTTPS via Cloudflare to spy on U.S. healthcare and education sectors.

New CRESCENTHARVEST Malware Targets Iranian Dissidents Zyxel security - Mitel MiCollab Vulnerability

New CRESCENTHARVEST Malware Targets Iranian Dissidents

Do Son February 18, 2026

Acronis uncovers CRESCENTHARVEST, a new spyware targeting Iranian dissidents. Attackers use protest lures & Google DLL sideloading to steal data.

Virtual Invasion: SolarWinds WHD Exploited to Host Hidden QEMU VMs SolarWinds Web Help Desk QEMU Persistence

Virtual Invasion: SolarWinds WHD Exploited to Host Hidden QEMU VMs

Do Son February 10, 2026

Microsoft finds hackers using SolarWinds WHD to run hidden QEMU VMs. The attack uses DLL sideloading for full domain compromise. Patch immediately.

Signed & Stolen: “Phantom Stealer” Hijacks Java App via Fake DHL Invoice Xloader Malware Information Stealer Phantom Stealer v3.5.0 DLL Sideloading Attack

Xloader Malware Information Stealer Phantom Stealer v3.5.0 DLL Sideloading Attack

Signed & Stolen: “Phantom Stealer” Hijacks Java App via Fake DHL Invoice

Do Son February 2, 2026

Attackers use fake DHL invoices to sideload Phantom Stealer v3.5.0 via a signed Java utility. Malware hides in AddInProcess32.exe. Watch out.

Fake Malwarebytes Campaign Exploits DLL Sideloading to Drop Infostealers GuLoader Malware CloudEye Obfuscation npm, malware Ethereum, npm supply chain OAST techniques StilachiRAT macOS Malware PasivRobber

GuLoader Malware CloudEye Obfuscation npm, malware Ethereum, npm supply chain OAST techniques StilachiRAT macOS Malware PasivRobber

Fake Malwarebytes Campaign Exploits DLL Sideloading to Drop Infostealers

Do Son January 19, 2026

New malware campaign impersonates Malwarebytes installers. Hackers use DLL sideloading to deploy infostealers targeting crypto & MFA. Verify downloads now.

New “LOTUSLITE” Backdoor Targets U.S. Government in Suspected Mustang Panda Campaign Harvester APT Linux Backdoor OT Cyberattack Iranian APT Operation Olalampo MuddyWater APT Prince of Persia APT, Tonnerre v50 Patchwork APT, DLL Sideloading Subtle Snail, cyber espionage ShadowSilk, cyber espionage Volt Typhoon APT Group - Chinese Cybersecurity Firm

Harvester APT Linux Backdoor OT Cyberattack Iranian APT Operation Olalampo MuddyWater APT Prince of Persia APT, Tonnerre v50 Patchwork APT, DLL Sideloading Subtle Snail, cyber espionage ShadowSilk, cyber espionage Volt Typhoon APT Group - Chinese Cybersecurity Firm

New “LOTUSLITE” Backdoor Targets U.S. Government in Suspected Mustang Panda Campaign

Do Son January 19, 2026

Mustang Panda targets US gov with new LOTUSLITE backdoor. Campaign uses Venezuela lures and DLL sideloading to evade detection.

Trusted Tool Turned Traitor: Signed ‘ahost.exe’ Weaponized to Sideload Malware ahost.exe DLL Sideloading Signed Application Abuse PS1Bot, malware ransomware attacks bill

ahost.exe DLL Sideloading Signed Application Abuse PS1Bot, malware ransomware attacks bill

Trusted Tool Turned Traitor: Signed ‘ahost.exe’ Weaponized to Sideload Malware

Do Son January 16, 2026

Attackers exploit legitimate ahost.exe via DLL sideloading to deploy RATs & stealers. Trusted dev utility bypasses security scanners. Watch out.

Evasive Panda APT Hijacks Dictionary.com and App Updates in Two-Year Spree Evasive Panda, AitM

Evasive Panda APT Hijacks Dictionary.com and App Updates in Two-Year Spree

Do Son December 25, 2025

Kaspersky exposes Evasive Panda’s AitM campaign, hijacking DNS to deliver MgBot through fake updates for SohuVA and Tencent QQ.

Storm-0249 Abuses EDR Process via DLL Sideloading to Cloak Ransomware Access Storm-0249 EDR Abuse, DLL Sideloading

Storm-0249 Abuses EDR Process via DLL Sideloading to Cloak Ransomware Access

Do Son December 15, 2025

Storm-0249 IAB abuses the SentinelOne EDR process via DLL sideloading to evade detection. The group uses LoLBin tools for fileless execution and sells access to ransomware groups like LockBit.