HijackLoaderMalware
- doiloader
- GHOSTPULSE
- IDAT Loader
- SHADOWLADDER
According to Rapid7, this is a loader first spotted in July 2023. It implements several evasion techniques including Process Doppelgänging, DLL Search Order Hijacking, and Heaven's Gate. It has been observed to store its malicious payload in the IDAT chunk of PNG file format.From MISP Galaxy
Last reported 1 month ago, by Cisco Talos14 reports
ATT&CK techniques
6 of 52 · each with the sentence it comes from- T1684Social Engineering
“GTIG analysis and the maintainer's post mortem indicate that the maintainer account was compromised via social engineering and used to publish the updated versions.”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1055Process Injection
“* [Process Injection: Thread Execution Hijacking](hxxps://attack.mitre.org/techniques/T1055/003/)”
- T1553.002Code Signing
“Hardware-Backed Key Protection: Secure code-signing certificates using Hardware Security Modules (HSMs) or vaulting solutions.”
- T1036Masquerading
“The masquerading themes we’ve observed include installers for Chrome, Brave, Edge, Grammarly, and WebEx to highlight a few.”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
14 reports, newest first · the exact sentence from each-
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager“G DATA documented module stomping in a HijackLoader chain that delivered ACRStealer, using different DLLs, "evr.dll", and "rasapi32.dll" rather than the "dbghelp.dll" observed in our case.”
-
Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise“…re used in consumer-facing websites: in one case, automotive dealership websites served ClickFix lures leading to the installation of SHADOWLADDER (aka SectopRAT), and in another, eCommerce websites were infected with web skimmers.”
-
ErrTraffic: A Growing ClickFix Malware Distribution Framework“In this instance, the final payload delivered was identified as HijackLoader.”
-
Intelligence Insights: June 2026“HijackLoader”
-
The dual-use dilemma: Rethinking detection for remote access tool abuse“…sistence, researchers detected it sideload malicious DLLs before ultimately downloading and executing the DeerStealer infostealer and HijackLoader.”
-
ClearFake's Variant: Web3 Exploitation for Malware Delivery“During this period, ClearFake delivered loader malware to Windows systems, including Amadey, IDAT Loader, and HIjack Loader.”
-
ClickFix tactic: The Phantom Meet Infostealer Campaign“…88b4446be57543858adcc704e8534326d4d84ac44a60743b1a44cbfe)are the Stealc and Rhadamanthys payloads respectively, both protected by the HijackLoader crypter.”
-
Technical Analysis of SnappyClient“…caler ThreatLabz identified a new command-and-control (C2) framework implant that we track as SnappyClient, which was delivered using HijackLoader.”
-
JSAC2026 -Workshop/Lightning Talk Session/Panel Discussion-“On Windows systems, this resulted in the execution of malware including HijackLoader, while on macOS systems, it led to infection with AMOS Stealer.”
-
Taking SHELLTER: a commercial evasion framework abused in-the-wild“…](hxxps://www.elastic.co/security-labs/a-wretch-client) by our team on June 17th when we discussed this threat in association with the GHOSTPULSE loader.”
-
A Wretch Client: From ClickFix deception to information stealer deployment“Our telemetry has tracked its use since last year, including instances leading to the deployment of new versions of the GHOSTPULSE loader.”
-
Chasing Eddies: New Rust-based InfoStealer used in CAPTCHA campaigns“We have also encountered a similar campaign distributing GHOSTPULSE in late 2024.”
-
Tricks and Treats: GHOSTPULSE’s new pixel-level deception“Tricks and Treats: GHOSTPULSE’s new pixel-level deception”
-
GHOSTPULSE haunts victims using defense evasion bag o' tricks“GHOSTPULSE haunts victims using defense evasion bag o' tricks”
Indicators in its reports
named in the reports above- 185.156.72[.]80in 2 reports
- flare[.]ioin 1 report
- verification[.]googlein 1 report
- pf[.]chin 1 report
- leaguejazire[.]comin 1 report
- riyazinikokar[.]xyzin 1 report
- hxxps://telegra[.]ph/Functions-04-03in 1 report
- 145.249.109[.]147in 1 report
- 45.150.34[.]2in 1 report
- 279d04c0cfd700c8…772739aecb92in 1 report
- lb.propertyfind[.]ccin 1 report
- fd.gstats-api-contact[.]ccin 1 report
- pkg.vogueatelier[.]ccin 1 report
- kffd3.vogueatelier[.]ccin 1 report
- kffd3.vexlatech[.]ccin 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.