--- title: Hackers Exploit c-ares DLL Side-Loading to Bypass... description: Active malware campaigns are exploiting DLL side-loading vulnerabilities in GitKraken's signed ahost.exe binary to bypass security controls and deploy trojans,... canonical: https://daily.dev/posts/hackers-exploit-c-ares-dll-side-loading-to-bypass-security-and-deploy-malware-48lcnrfvq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware | daily.dev og:description: Active malware campaigns are exploiting DLL side-loading vulnerabilities in GitKraken's signed ahost.exe binary to bypass security controls and deploy trojans,... og:url: https://daily.dev/posts/hackers-exploit-c-ares-dll-side-loading-to-bypass-security-and-deploy-malware-48lcnrfvq og:image: https://api.daily.dev/og/posts/48lcNRfVQ.png og:image:alt: Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware **[The Hacker News](https://daily.dev/sources/thn)** · 5 min read · 0 upvotes · 0 comments ## Summary Active malware campaigns are exploiting DLL side-loading vulnerabilities in GitKraken's signed ahost.exe binary to bypass security controls and deploy trojans, stealers, and remote access tools like Agent Tesla, Formbook, Lumma Stealer, and Remcos RAT. Attackers pair malicious libcares-2.dll files with legitimate signed executables, leveraging search order hijacking to execute malicious code. Separate phishing campaigns use Browser-in-the-Browser techniques to simulate Facebook login screens and steal credentials, while multi-stage attacks abuse TryCloudflare tunnels and Python payloads to distribute AsyncRAT. These campaigns target finance, procurement, and supply chain employees across commercial and industrial sectors using invoice and legal notice lures in multiple languages. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Hackers Use LinkedIn Messages to Spread RAT Malware Through DLL Sideloading](https://daily.dev/posts/hackers-use-linkedin-messages-to-spread-rat-malware-through-dll-sideloading-hcaxdmj5q) · The Hacker News · 0 upvotes · 0 comments - [Threat Actors Weaponize AI Hype to Deliver AsyncRAT](https://daily.dev/posts/threat-actors-weaponize-ai-hype-to-deliver-asyncrat-mwevh7dcd) · FortiGuard Threat Research · 0 upvotes · 0 comments - [Microsoft warns of surge in ACR Stealer attacks on customers](https://daily.dev/posts/microsoft-warns-of-surge-in-acr-stealer-attacks-on-customers-mtjfp3laf) · BleepingComputer · 0 upvotes · 0 comments - [Fake Google and Cloudflare verification pages spread multiple malware families](https://daily.dev/posts/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families-8s8xqrwfw) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/hackers-exploit-c-ares-dll-side-loading-to-bypass-security-and-deploy-malware-48lcnrfvq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware","url":"https://daily.dev/posts/hackers-exploit-c-ares-dll-side-loading-to-bypass-security-and-deploy-malware-48lcnrfvq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-exploit-c-ares-dll-side-loading-to-bypass-security-and-deploy-malware-48lcnrfvq"},"datePublished":"2026-01-14T14:25:37.924Z","dateModified":"2026-08-24T07:03:17.467Z","description":"Active malware campaigns are exploiting DLL side-loading vulnerabilities in GitKraken's signed ahost.exe binary to bypass security controls and deploy trojans,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fbdd7eb2e669695e8952c704a6c1e2ef?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fbdd7eb2e669695e8952c704a6c1e2ef?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"The Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/thn","url":"https://daily.dev/sources/thn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-exploit-c-ares-dll-side-loading-to-bypass-security-and-deploy-malware-48lcnrfvq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,python,malware,phishing","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Hacker News","item":"https://daily.dev/sources/thn"},{"@type":"ListItem","position":3,"name":"Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware"}]} ```