Trojanized FileZilla DLL Sideloading

Ethan Andrews@eandrews

•updated Mar 2, 2026•13•0•67

Detects the loading of 'version.dll' by 'filezilla.exe' from a non-system directory. This behavior is a strong indicator of a DLL Sideloading attack used by a trojanized FileZilla variant. Legitimate FileZilla distributions do not ship with this DLL.