ValleyRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading
Essential information
- Published
- 03/12/2025 09:29
- Modified
- 21/12/2025 18:18
- Tags
- 2025-12-03 data theft dll side-loading foxit pdf reader job seekers remote access trojan social engineering valleyrat
- Related entities
- 25 observables, 1 intrusion sets (apt), 12 techniques (mitre), 1 malware
Description
A ValleyRAT campaign is targeting job seekers through email, disguising itself as a Foxit PDF reader and using DLL side-loading for initial system access. The campaign exploits job seekers' eagerness by using recruitment-related lures in archive files. The attack employs sophisticated techniques, including obfuscation through nested directories and execution via DLL sideloading. Once activated, ValleyRAT can lead to system control, activity monitoring, and data theft. The campaign's success is evident from a spike in ValleyRAT detections. It demonstrates the integration of social engineering, legitimate software abuse, and advanced malware techniques to exploit vulnerabilities in both systems and human psychology.