Attackers Abuse VLC Media Player and VMware Tools to Side-Load Malware

Threat actors are turning to some of the most trusted names in enterprise software to slip malicious code past security controls. According to reporting from Cyber Security News, three separate malware campaigns are abusing legitimate components of VLC Media Player and VMware Tools to load harmful payloads on Windows systems, primarily targeting users in Brazil and Portugal.

The technique at the center of these operations is DLL side-loading, a well-established but persistently effective method for evading detection. Rather than dropping an obviously malicious executable, attackers place a weaponized dynamic-link library alongside a genuine, digitally signed application. When the trusted program launches, it loads the rogue DLL from its own directory instead of the legitimate one, and the malware executes under the cover of a reputable binary.

Why Legitimate Software Makes an Attacker's Job Easier

DLL side-loading works because Windows applications frequently search for dependencies in the folder they were launched from before checking system directories. Security tools and users alike tend to give signed software the benefit of the doubt, so a payload riding on VLC or VMware binaries can blend into normal activity. Because the host application is genuine and properly signed, signature-based detection often fails to flag the compromise.

The choice of VLC Media Player is notable. The media player is ubiquitous on consumer and business endpoints, making it an inconspicuous carrier for malicious libraries. VMware Tools, meanwhile, is commonly installed on virtualized infrastructure and administrative workstations, which raises the stakes: a foothold on such systems can offer attackers a path toward broader network access.

Phishing Lures Built Around Everyday Documents

The campaigns reportedly rely on social engineering to get victims to launch the bundled files. Lures include fake legal notices, financial documents, and invoice download pages — themes designed to provoke urgency and routine clicks among Portuguese- and Brazilian Portuguese-speaking users. These topics are especially effective in regions where invoices and legal correspondence are frequently exchanged by email and messaging apps.

The attacks combine multiple stages: phishing messages deliver archives or installers, hidden scripts set up the environment, and the side-loaded trusted programs then execute the final payload. This layered approach means defenders must catch the intrusion at several points — the initial lure, the script execution, or the anomalous library load — rather than relying on a single detection opportunity.

Defensive Guidance

Organizations can reduce exposure to this class of attack with a combination of controls and monitoring:

  • Restrict execution from user-writable directories. Enforcing application control policies that prevent binaries and libraries from running out of Downloads, Temp, and similar folders blunts many side-loading attempts.
  • Monitor for anomalous DLL loads. Endpoint detection and response tooling can flag signed applications loading unsigned or unexpected libraries from unusual paths. Alerting on these events is far more reliable than waiting for a known-bad hash.
  • Harden email and web gateways. Blocking or sandboxing archive attachments and invoice-themed lures, and inspecting downloads for bundled DLLs, can stop the chain early.
  • Patch and inventory. Keeping VLC and VMware Tools current, and knowing where they are installed, helps teams spot tampered installations. Removing unnecessary copies of these applications also shrinks the attack surface.
  • User awareness. Because the lures imitate legal and financial correspondence, targeted awareness training for finance and administrative staff in Portuguese-speaking regions is worth prioritizing.

The Bigger Picture

This activity fits a broader pattern: adversaries increasingly prefer to "live off the land" by co-opting legitimate, signed software rather than deploying custom droppers that attract attention. VLC and VMware Tools join a long list of applications — including productivity suites, security agents, and gaming software — that have been repurposed as malware hosts in recent years.

The takeaway for defenders is that trust in a vendor's signature is not the same as trust in a file's location or behavior. Validating what a signed binary actually loads, and from where, remains one of the most dependable ways to catch side-loading campaigns before they escalate.

For the full report, see the original coverage at Cyber Security News.