Hijack Loader

Hijack Loader is a modular Windows malware loader, also referred to in the provided content as DOILoader and IDAT Loader, that serves as a conduit for additional payloads including information stealers and remote access trojans. Reported follow-on malware delivered via Hijack Loader includes Rhadamanthys, Lumma Stealer, RedLine Stealer, Atomic Stealer, ACR Stealer, and Remcos RAT. In one described chain, a DLL decrypts embedded data, reconstructs the Hijack Loader payload in memory, and injects shellcode into a newly spawned process; another report states RenEngine Loader decrypts, stages, and transfers execution to Hijack Loader. The malware has been described as using signed legitimate code-signing certificates to evade detection, and campaigns involving it have used in-memory reconstruction, DLL side-loading, module stomping, process injection, and scheduled-task persistence.

Observed delivery vectors in the content include compromised websites and the ClearFake framework, ClickFix-style fake CAPTCHA or troubleshooting lures, SEO poisoning, malicious installers, pirated or cracked software themes, and compromised YouTube channels. ClearFake campaigns delivered Hijack Loader to Windows systems, and separate ClickFix campaigns used Hijack Loader to drop RedLine Stealer. A GPUGate campaign used a malicious installer targeting users searching for developer tools to deliver Hijack Loader and Atomic Stealer. Compromised YouTube accounts advertised cracked software such as Adobe Photoshop via MSI installers that deployed Hijack Loader and then Rhadamanthys. The malware has also appeared in campaigns using fake Cloudflare CAPTCHA pages and in CastleLoader-related ecosystems.

The content links Hijack Loader to multiple threat actors and operations. It was targeted in the May 2025 Operation Endgame action. A Russia-aligned threat actor tracked as UAC-0184 / Hive0156 used Viber-delivered spearphishing against Ukrainian military and government entities, including the Verkhovna Rada, with weaponized ZIP archives containing malicious LNK files that ultimately deployed Hijack Loader and then Remcos RAT. In that activity, legitimate executables such as CFlux.exe and Chime.exe were abused for DLL side-loading, and Remcos RAT was injected into Chime.exe. The content also notes broader criminal use of Hijack Loader in campaigns distributing stealers and RATs across Windows environments.

High-confidence behavioral details from the content include use as a secondary or intermediate loader, decryption and staging of payloads in memory, shellcode injection into spawned processes, deployment of Remcos RAT via injection into Chime.exe, environmental checks for security software in at least one campaign, and persistence via scheduled tasks. No standalone network indicators or hashes are provided in the content.