VLC, VMware Tools DLL sideloading lets attackers bypass security

Key Takeaways

• Attackers are exploiting DLL sideloading vulnerabilities in legitimate software like VLC Media Player and VMware Tools.
• The campaigns primarily target users in Brazil and Portugal, employing phishing emails with fake legal and financial documents.
• Three distinct malware operations – Overlord RAT, Lampion banking malware, and a malicious driver management library – utilize these techniques.
• The core tactic involves tricking trusted applications into loading malicious Dynamic Link Libraries (DLLs) from unexpected locations.
• No specific patches are available for the DLL sideloading vector itself, requiring robust endpoint detection and user awareness.

Sophisticated DLL Sideloading Attacks Bypass Security with VLC, VMware Tools

Cybercriminals are increasingly leveraging trusted software components from VLC Media Player and VMware to inject malicious code onto Windows systems, effectively cloaking their harmful activities behind legitimate applications. This sophisticated approach makes detection significantly more challenging for conventional security measures.

These operations are part of three distinct malware campaigns primarily aimed at users in Brazil and Portugal. Attackers employ deceptive tactics, including fake legal notices, financial documents, and fraudulent invoice download pages, to initiate infections. The campaigns skillfully integrate phishing, obfuscated scripts, and the abuse of trusted programs to enhance their stealth and evade detection.

The central technique employed is DLL sideloading. This method manipulates a genuine application into loading a malicious DLL, a file containing supporting code. Instead of directly modifying the trusted executable, attackers strategically place a malicious library alongside it. When the legitimate application launches, it inadvertently loads the attacker’s harmful DLL, allowing the malicious code to execute within the context of a trusted process. This tactic necessitates that defenders scrutinize not only the main program but also its associated libraries.

WatchGuard Red Cell researcher Euler Neto identified these activities during an investigation into the three campaigns, with findings published on October 22, 2026. The research details the Overlord RAT, the Lampion banking malware, and a separate infection involving a malicious driver management library. While these cases share similar delivery mechanisms, the investigation did not definitively establish a single threat actor or group behind all three operations.

Hackers Exploit VLC Media Player and VMware Tools

The Overlord RAT campaign commences with phishing emails impersonating Brazilian notary offices. These emails entice recipients to click on links leading to purported legal documents. The links, in turn, deliver VBScript files designed to download further executables or Windows Installer packages. Some of these scripts employ character codes to construct their instructions, while others concatenate strings, making their true purpose harder to discern during analysis.

WatchGuard’s analysis of two installer packages revealed the use of DLL sideloading. One instance paired a malicious library with a legitimate Microsoft .NET Framework utility (ngentask.exe), while another exploited the VLC Media Player (vlc.exe). Both scenarios involved placing the malicious files within a temporary folder named “Adobe.” This highlights a critical vulnerability: security solutions that only examine the main executable can easily miss the malicious library responsible for the actual execution.

Other delivery vectors for Overlord include the use of Dropbox or Google Cloud Storage to retrieve additional payloads. Batch scripts observed in these attacks attempt to establish Microsoft Defender exclusions, while downloaded programs create persistent scheduled tasks or startup entries. One loader even masquerades as Windows Error Reporting (WerFault.exe) to blend in with normal system activity. Researchers also uncovered encrypted content that decoded into Donut shellcode, enabling the execution of further payloads directly in memory.

The VMware-related attack chain begins with a Portuguese invoice page titled “Download Seguro – Factura.” A deceptive CAPTCHA prompts visitors to download an ISO disk image. Inside this ISO, analysts found an obfuscated VBScript, a genuine VMware network installation utility (vnetlib.exe), a malicious DLL (newdev.dll), and a module-definition file. Here, the trusted VMware executable acts as the loader for the malicious component, not the final malware itself.

This packaging strategy mirrors earlier ISO-based malware delivery schemes that bundled legitimate software with harmful libraries. In this specific case, the malicious DLL decrypts embedded data using XOR, revealing a second, 64-bit DLL written in Pascal. This Pascal payload performs initial checks for existing infections, prepares for screen capture, generates a unique bot identifier, and establishes a user-level registry entry for persistence.

Remote Access Capabilities and Detection Priorities

The Pascal payload grants attackers extensive control over compromised systems. Its command-and-control capabilities include remote mouse and keyboard control, command execution via PowerShell or CMD, file writing, screen streaming, and hidden interactive shells. It also possesses self-uninstall capabilities, allowing it to remove forensic evidence. Failed connections to its command server are retried every three seconds, a behavior that defenders can use as an indicator of compromise.

WatchGuard also investigated Lampion, a banking malware distributed through finance-themed phishing messages and heavily padded scripts. In one notable example, a script measured approximately 5 MB, yet its functional code comprised only about 5 KB. Lampion primarily targeted Portugal, contrasting with the Overlord campaign’s focus on Brazil. While recurring references to the number seven were observed across the cases, this alone does not conclusively link the operations to a single threat actor.

For security teams, critical warning signs include unexpected script downloads, the creation of new Microsoft Defender exclusions, unfamiliar scheduled tasks, and legitimate applications loading libraries from unusual or temporary directories. Previous attacks, such as those involving fake Claude installers, have also combined security exclusions with sideloading, illustrating how multiple seemingly ordinary Windows actions can form a cohesive infection chain. Investigators must correlate these events rather than analyzing each alert in isolation.

What You Should Do

• Monitor Process Chains: Thoroughly review process execution chains for any legitimate applications loading DLLs from atypical or temporary directories.
• Scrutinize Persistence Mechanisms: Regularly check for newly created scheduled tasks, startup entries, or registry modifications that could indicate malware persistence.
• Inspect Outbound Connections: Monitor network traffic for unusual outbound connections, especially to known command-and-control IPs or suspicious ports.
• Implement Strong Phishing Protection: Educate users on identifying and reporting phishing attempts, particularly those involving legal documents, invoices, or financial notices.
• Enhance Endpoint Visibility: Deploy advanced endpoint detection and response (EDR) solutions to gain deeper insights into system behavior and detect anomalous activities across scripts, cloud downloads, and Windows features.
• Isolate Compromised Endpoints: Have a clear incident response plan to quickly isolate any endpoints identified as compromised to prevent further lateral movement.
• Verify Software Integrity: Always download software from official vendor websites and verify its integrity using checksums where available.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.