20260114-thehackernews.com-4b682 | Perceptive Security

< Back to index

Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware

Published:

14 January 2026 at 14:18:00

Alert date:

14 January 2026 at 15:01:03

Source:

thehackernews.com

Supply Chain & Dependencies, Ransomware & Malware

Security researchers have identified an active malware campaign exploiting a DLL side-loading vulnerability in the c-ares library. Attackers are pairing a malicious libcares-2.dll with legitimate signed ahost.exe binaries to bypass security controls. The campaign is being used to deploy various commodity trojans and stealers while evading detection through the abuse of legitimate software components.

Technical details

Attackers exploit DLL side-loading vulnerability in c-ares library by pairing malicious libcares-2.dll with legitimate signed ahost.exe binary from GitKraken Desktop. The vulnerability allows search order hijacking where the malicious DLL is placed in the same directory as the vulnerable binary, causing execution of rogue DLL instead of legitimate counterpart. The campaign uses social engineering with invoice and RFQ-themed lures in multiple languages. Additionally, a separate campaign uses Browser-in-the-Browser technique to create fake Facebook login screens within iframe elements for credential harvesting.

Mitigation steps:

Monitor for DLL side-loading attacks involving ahost.exe and libcares-2.dll. Implement controls to detect unsigned or suspicious DLL files in application directories. Be cautious of email attachments with invoice/RFQ themes and executable files disguised as PDFs. Verify legitimacy of Facebook login prompts and check URLs carefully. Implement application whitelisting and endpoint detection rules for DLL side-loading techniques. Train users to recognize social engineering tactics using fake legal notices and copyright violation claims.

Affected products:

c-ares library
GitKraken Desktop (ahost.exe binary)
libcares-2.dll