Cyber security
IT
Business Practices
You and your exec team treating LinkedIn like “just another networking” site?
If the answer is yes, you’ve got a blind spot in your cyber strategy. Right now there are active campaigns using LinkedIn DMs with file attachments to gain remote access to senior leaders’ devices – with the same seriousness we usually reserve for email‑based threats. For many organisations, this sits completely outside their security monitoring and policy framework.
How LinkedIn attachments became an attack vector
Recent research has highlighted phishing campaigns that weaponise LinkedIn direct messages to deliver Remote Access Trojans (RATs) using multi‑stage techniques like DLL sideloading. Attackers lean heavily on LinkedIn’s professional credibility and the trust people place in “warm” messages from seemingly legitimate profiles.
The attack unfolds like this:
- An executive, IT admin or senior staff member receives a DM about a deal, job, partnership or project.
- The message includes or leads to a file – often a WinRAR self‑extracting archive (SFX) or compressed attachment masquerading as a PDF, proposal or CV
- When opened, the archive drops a legitimate application (like a PDF reader) plus a malicious DLL, and often a Python interpreter or script.
- The malicious DLL is sideloaded by the legitimate app, giving the attacker persistent remote access while hiding under a trusted process.
Let me be clear, the above is not theoretical; advisories from incident response teams and multiple vendors have documented these LinkedIn‑based campaigns targeting enterprises across sectors, including technology, finance and professional services - this is real and happening now.
Why attackers love targeting executives on LinkedIn
These are high‑priority attacks for a simple reason: executives offer a high‑value shortcut into your organisation.
Attackers are specifically going after roles such as CEOs, CFOs, IT admins, HR leaders and anyone with privileged access, financial authority or strategic intel. LinkedIn is the perfect hunting ground because titles, responsibilities and connections are all on display.
The payloads are disguised as exactly the kind of files leaders expect to see:
- Job offers and candidate CVs
- Board papers and investor decks
- Contracts and RFP responses
- Project plans and product roadmaps
File types are recognisable, business‑friendly and don't immediately trigger suspicion – RAR, ZIP, PDF or even DOCX – the nastiness comes wrapped in self‑extracting archives that launch the infection chain from these files. Once opened, these attachments can deliver RAT (Remote Access Technology) malware that allows the attackers to quietly, efficiently and effectively:
- Steal credentials and sensitive documents
- Provides persistent, interactive remote access
- Allows lateral movement into core systems
- Exfiltrates data over time, not just in one hit
For an SME or mid‑market organisation, one compromised executive device can be enough to pivot into finance systems, internal (or worse, customer) data stores or even your Microsoft 365 tenancy!
What these attacks look like in practice
- A campaign identified by ReliaQuest and reported by The Hacker News used LinkedIn DMs to push WinRAR SFX archives that deployed a legitimate PDF reader alongside a malicious DLL and Python‑based shellcode, ultimately installing a RAT and creating registry‑based persistence.
- Advisory NCC‑CSIRT‑2026‑001 described similar behaviour: executives and IT staff were contacted via LinkedIn, enticed to run a self‑extracting archive, and unknowingly triggered DLL sideloading that hid malicious execution under a trusted PDF process.
- Threat intel posts on LinkedIn and security blogs highlight that these operations are broad and opportunistic, spanning multiple industries, but consistently focusing on “high‑value” professionals whose devices are a stepping stone into corporate networks.
The common thread with all of these attacks - email was replaced by LinkedIn as the initial foothold into the target Organisation - a platform that is rarely monitored and widely used amongst senior executives.
Five practical policy shifts
At Microsolve, these are the five points we encourage clients to bake into their cyber policy – these are not just “common sense” reminders that rely on people having a good day - they are targeted, contextual and pragmatic.
- Default stance: treat all LinkedIn attachments as untrusted
Make it clear in policy that LinkedIn is not an approved channel for moving business documents. Any file relevant to deals, finance, HR or operations must flow through sanctioned channels like email, Microsoft 365 or a secure file‑sharing platform – where you have logging, DLP and malware scanning in place. LinkedIn attachments should be considered untrusted by default. - Deploy an Exec playbook: a one‑page checklist, not a 30‑page policy!
Executives don’t need a manual; they need a simple, memorable playbook. I recommend a single page that covers:- Context check – Was I expecting this file from this person?
- Sender check – Does the profile and backstory stack up, and do we have an existing relationship?
- File check – Is this a compressed archive or executable masquerading as a document?
- Verification – Can I confirm via a second channel (known email, mobile, Teams)?
- IT first – If in doubt, forward to IT/security to open in a controlled environment.
(Context --> Sender --> File --> Verify --> IT First)
- Technical guardrails: leverage the tools you already own
Where possible, tighten the environment so a single bad decision is less likely to be catastrophic (these measures don’t eliminate risk, but they significantly reduce the blast radius when a download is opened):- Log or restrict LinkedIn file downloads on corporate devices via web filters or CASB controls.
- Enforce endpoint controls (EDR, application whitelisting, WDAC/AppLocker) that block unknown executables, archives and interpreters like Python where they’re not required.
- Monitor for suspicious patterns such as PDF readers spawning unusual processes, DLL sideloading events and unexpected outbound connections associated with RAT command‑and‑control.
- Awareness with real LinkedIn examples
Awareness training works best when it feels real. Use screenshots (sanitised) or recreated examples from recent LinkedIn phishing campaigns, including job‑themed lures, proposal requests and weaponised archives. Show people exactly what a malicious “UpcomingProducts.pdf” SFX archive looks like in a DM so they recognise the pattern, not just the theory. - Incident drill: assume someone will click
No matter how strong your controls, at some point someone will open the wrong file. Plan for that scenario now:- Define who the user calls first (service desk, CISO, managed security provider).
- Document how to isolate the device quickly (network segmentation, remote EDR containment).
- Prepare communication templates for internal stakeholders and customers if data may be affected.
- Capture lessons learned and update controls, not just close the ticket.
Bringing it together for your organisation
When you formalise how your organisation handles LinkedIn DMs and attachments, you move from hoping staff are careful to implementing an engineered control across people, process and technology. The outcome is simple: your executives stay focused on deals and strategy, not recovering from a preventable breach triggered by a “quick look” at an unexpected LinkedIn attachment.
If you’d like support turning this into a concrete playbook, controls configuration and executive awareness session tailored to your business, that’s exactly the kind of pragmatic cyber resilience work we do every day at Microsolve.
