12/04/2026
There’s a phishing campaign doing the rounds that skips email entirely 🫨
And you guessed it: That’s what makes it effective 😬
Security researchers have uncovered a targeted attack aimed at executives and IT admins, delivered through LinkedIn messages.
The setup is deliberately convincing.
The victim is contacted about a job opportunity or a business project. Nothing obviously suspicious.
The message includes a download link to what looks like a relevant document. It’s often named to match the person’s role, like a product roadmap or project plan.
Click the link, and a file downloads.
It’s a self-extracting archive created with WinRAR, which opens like a normal folder.
Inside are several files that appear legitimate, including a PDF reader.
So far, everything looks routine.
When the document is opened, though, something else happens behind the scenes: The PDF reader loads a malicious file bundled alongside it.
This technique is called DLL sideloading, which is a way of sneaking harmful code in by hiding it next to a trusted application.
Because the program itself looks legitimate, security tools are less likely to raise an alarm straight away.
From there, the attack digs in 😰
It creates a startup entry, so it keeps running after a reboot, then launches a small Python tool that runs entirely in memory.
That tool opens a communication channel back to the attacker, giving them remote access to the machine.
At that point, the system is effectively under someone else’s control.
What’s worth paying attention to isn’t just the technical detail, it’s the delivery method 📧
The researchers were very clear that phishing no longer lives only in inboxes. Social platforms, messaging apps, and search results are increasingly being used because they feel informal and familiar.
We’re also less conditioned to be suspicious there, especially when the approach feels personalised and professional.
And LinkedIn is particularly attractive. It’s rich with role information, company context, and people who are used to receiving unsolicited outreach.
That makes it easier to tailor messages that don’t feel random.
The uncomfortable lesson here is that “I didn’t get an email” doesn’t mean “I wasn’t phished”.
Any platform that allows direct contact and file sharing can be abused. Especially when it’s used daily on work devices and trusted by default.
👉 When a message feels relevant, personalised, and arrives through a professional platform, what would make you hesitate before you click?
