Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware

Active malware campaigns are exploiting DLL side-loading vulnerabilities in GitKraken's signed ahost.exe binary to bypass security controls and deploy trojans, stealers, and remote access tools like Agent Tesla, Formbook, Lumma Stealer, and Remcos RAT. Attackers pair malicious libcares-2.dll files with legitimate signed Show more