Threat Actors Exploit Foxit PDF Reader to Seize System Access and Steal Data

ValleyRAT Campaign Leveraging PDF Reader in Email Attacks

A sophisticated malware campaign is utilizing a compromised Foxit PDF Reader to target job seekers through email-based attacks, deploying the ValleyRAT remote access trojan (RAT).

This malware grants threat actors full system control and data exfiltration capabilities. Recent research has identified a significant increase in this campaign, which employs social engineering, obfuscation techniques, and dynamic-link library (DLL) sideloading to compromise users.

The ValleyRAT poses a significant threat to both individual job seekers and organizations, particularly those with human resource departments. Once deployed, it enables attackers to monitor system activity, steal sensitive information, and maintain persistent access to infected devices.

Beyond their usual targets of Chinese-speaking users, the attackers are now targeting job seekers more broadly. This campaign demonstrates increased sophistication, utilizing multiple attack vectors to enhance success rates and evade security defenses.

The campaign exploits psychological vulnerabilities in job seekers. Threat actors distribute archive files with recruitment-themed names, such as "Overview_of_Work_Expectations.zip" and "Candidate_Skills_Assessment_Test.rar," through email. These deceptive lures capitalize on the emotional strain and urgency experienced by job seekers, increasing the likelihood of rapid file downloads.

The technical execution involves archive files containing a renamed version of FoxitPDFReader.exe, disguised with recruitment-related filenames. This creates an initial deception layer, leading users to believe the files are legitimate PDF documents.

Upon execution, the malware employs DLL sideloading, exploiting the Windows DLL search order mechanism to execute malicious code. This process involves a hidden msimg32.dll alongside deeply nested directory structures, obscuring the malware's presence.

The infection chain uses a multi-stage deployment process. A batch file extracts a disguised 7-Zip executable that retrieves a Python environment from within a document.pdf file. The renamed Python interpreter executes a shellcode loader that downloads base64-encoded malicious scripts from command-and-control servers, establishing persistent access.

The ValleyRAT payload systematically steals data from users' internet browsers, capturing credentials, browsing history, and other sensitive information. The malware communicates with command-and-control infrastructure using self-signed certificates, typical of off-the-shelf RAT builders.

Organizations can utilize security platforms to detect and block indicators of compromise associated with this campaign. Security awareness training is essential to help users recognize recruitment-themed phishing attempts and suspicious executable files.

By understanding these sophisticated attack methodologies, individuals and enterprises can implement proactive defenses to prevent compromise and data theft.

Based on reporting by GBHackers.