Hackers Use Resume-Themed LNK Files to Deploy Xctdoor Backdoor via DLL Side Loading

Cybersecurity researchers have uncovered a new malware campaign targeting corporate environments using resume-themed LNK shortcut files.

Threat actors are disguising malicious shortcuts as job applications, specifically customizing the file names to include the targeted company’s name and a relevant job title.

When an unsuspecting employee opens the file, it displays a legitimate-looking decoy resume while silently triggering a complex infection chain in the background.

This attack ultimately deploys the Xctdoor backdoor, allowing attackers to establish persistent, unauthorized access to compromised systems.

Because human resources, sales, and customer-facing departments frequently handle external documents, this social engineering tactic poses a significant risk to organizational security.

Windows operating systems often hide file extensions by default, making it incredibly easy for an employee to mistake a malicious shortcut for a standard PDF or Word document.

Resume Lures Deliver Xctdoor

The attack begins when a victim executes the malicious LNK file, typically formatted with the targeted company and job title. To avoid raising suspicion, the file opens a normal decoy document on the screen immediately.

However, the LNK file also stealthily generates a batch file, a PowerShell script, and a VBScript with randomized names inside the public videos directory. The dropped PowerShell script registers a scheduled task deceptively named “office365”.

This task is configured to run the VBScript every 10 minutes, ensuring the malware remains active even if the system reboots or if security software terminates the active processes.

The VBScript then executes the batch file, which uses the native command-line tool to download additional encrypted payloads from a remote server.

Once downloaded, these encoded files are decoded and saved as a new PowerShell script in the public pictures folder.

This secondary script decrypts the final payloads, dropping a legitimate Microsoft executable, a malicious DLL named ProximityCommon.dll, and an encrypted data file that serves as the backdoor.

To execute the final payload, the malware uses a technique known as DLL side-loading to trick a trusted, digitally signed program into running malicious code.

A newly created shortcut in the Windows Startup folder runs a legitimate executable that, in turn, loads the malicious DLL.

This DLL then injects the Xctdoor backdoor payload into a normal process to communicate with the attacker’s command-and-control server securely. The complete attack flow operates through a deliberate, multi-stage sequence.

It begins by executing the resume-themed malicious shortcut, which immediately displays the decoy document while silently creating hidden scripts and establishing task-scheduler persistence.

Once it has established a foothold, the malware downloads and decrypts secondary payloads from external servers.

Finally, the attack executes DLL side-loading using a legitimate executable, resulting in the successful injection of the Xctdoor backdoor.

According to ahnlab research, as attackers combine social engineering with legitimate system tools. The attack relies heavily on multiple layers of deception, making it difficult for an average user to realize their machine has been compromised.

Organizations can protect their networks by proactively hunting for specific indicators of compromise and taking immediate action to remove malicious artifacts.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.