Hackers Use VLC Media Player and VMware Tools to Load Malware Through DLL Side-Loading

Hackers are using legitimate VLC Media Player and VMware components to load malware onto Windows systems, hiding harmful code behind familiar software.

The activity forms part of three malware campaigns targeting users in Brazil and Portugal through fake legal notices, financial documents, and invoice download pages. The attacks combine phishing, hidden scripts, and trusted programs to make infections harder to spot.

The main technique, side-loading, tricks a genuine application into loading an attacker’s DLL, a file that supplies supporting code. Instead of changing the trusted executable, attackers place a harmful library beside it.

When the application starts, it loads the malicious file, giving defenders a reason to examine both the program and its nearby libraries.

WatchGuard Red Cell researcher Euler Neto identified the activity in an investigation of three campaigns published on October 22, 2026.

The research covers Overlord RAT, the Lampion banking malware, and a separate infection involving a malicious driver management library. Although the cases share delivery methods, the findings do not establish that one group controls all three operations.

Hackers Use VLC Media Player and VMware Tools

In the Overlord RAT campaign, phishing emails impersonate Brazilian notary offices and direct recipients toward supposed legal documents. The links deliver VBScript files that download executables or Windows Installer packages.

Some scripts hide their instructions by building text from character codes, while others join strings together to make their purpose less clear during inspection.

Two installer packages examined by WatchGuard used DLL side-loading. One paired a malicious library with a legitimate Microsoft .NET Framework utility; the other used VLC Media Player.

Both placed their files inside a temporary folder named Adobe. Similar DLL side-loading malware attacks show why checking only the main executable can miss the harmful library responsible for execution.

Other Overlord delivery paths use Dropbox or Google Cloud Storage to retrieve additional files. Batch scripts attempt to add Microsoft Defender exclusions, while downloaded programs create scheduled tasks or startup entries.

One loader uses the Windows Error Reporting name to blend into normal activity. Researchers also found encrypted content that decoded into Donut shellcode, allowing another payload to run in memory.

The VMware-related case starts with a Portuguese invoice page titled “Download Seguro – Factura.” A fake CAPTCHA leads visitors to download an ISO disk image.

Inside are an obscured VBScript, a genuine VMware network installation utility, a malicious DLL, and a module-definition file. The trusted VMware executable serves as the loading vehicle rather than the final malware itself.

That packaging resembles earlier ISO-based malware delivery chains that placed genuine software alongside harmful libraries. Here, the malicious DLL decrypts embedded data with XOR, revealing a second, 64-bit DLL written in Pascal.

Its main function checks whether another copy is running, prepares screen capture, creates a bot identifier, and sets a user-level registry entry for persistence.

Remote Access Capabilities and Detection Priorities

The Pascal payload gives attackers control over the infected computer. Its commands support remote mouse and keyboard activity, command execution through PowerShell or CMD, file writing, screen streaming, and hidden interactive shells.

It can also uninstall itself and remove associated evidence. Failed connections to its command server are retried every three seconds, providing another behavior defenders can investigate.

WatchGuard also reviewed Lampion, which uses finance-themed phishing messages and heavily padded scripts. In one example, a script measured roughly 5 MB, but its working code was only about 5 KB.

Lampion mainly targeted Portugal, while the Overlord case targeted Brazil. Repeated references to the number seven appeared across the cases, but those references alone do not prove a shared operator.

For security teams, the clearest warning signs are unexpected script downloads, new Defender exclusions, unfamiliar scheduled tasks, and trusted applications loading libraries from unusual folders.

Previous fake Claude installer attacks also combined security exclusions with side-loading, showing how several ordinary Windows actions can form one infection chain. Investigators should connect those events rather than assess each alert in isolation.

WatchGuard recommends reviewing process chains, persistence settings, and outbound connections, then isolating compromised endpoints where needed.

The practical lesson is to verify what trusted software loads, not simply whether its executable looks legitimate.

Phishing protection, behavior monitoring, and endpoint visibility remain important because these campaigns spread harmful activity across scripts, cloud downloads, libraries, and Windows features.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use VLC Media Player and VMware Tools to Load Malware Through DLL Side-Loading appeared first on Cyber Security News.