Loading malware…
HijackLoader, also known as IDAT Loader and sometimes tracked as GHOSTPULSE or SHADOWLADDER, is a modular Windows malware loader used to stage and execute a wide range of follow-on payloads. It is commonly employed as an intermediary component in intrusion chains rather than as the final objective, providing operators with flexible payload delivery, in-memory execution, and evasion features. Reported downstream payloads include information stealers, remote access trojans, banking malware, ransomware precursors, and legacy backdoors such as Carbanak.
A defining characteristic of HijackLoader is its use of concealed container formats and staged decryption to reconstruct malicious components only at runtime. Multiple campaigns have used steganographic or pseudo-image data, especially PNG IDAT-style chunking, combined with XOR or similar decoding and LZNT1 decompression to rebuild large loader bundles in memory. The framework has also been observed using shellcode stages, runtime API resolution, signed host binaries, and process hollowing or related image-replacement techniques to launch final payloads while reducing static detection opportunities.
HijackLoader is frequently delivered through social-engineering-heavy initial access chains. Observed vectors include ClickFix and paste-and-run lures, fake CAPTCHA and verification pages, spearphishing attachments, trojanized software installers, and DLL sideloading packages built around legitimate signed applications. It has also appeared in broader malware distribution ecosystems involving compromised WordPress sites, fake software updates, and malvertising-driven delivery chains. In several cases, users were tricked into manually executing PowerShell commands that downloaded and launched HijackLoader stages.
The loader is associated with financially motivated cybercrime activity and is widely used across malware delivery operations rather than being exclusive to a single threat actor. It has been linked to campaigns distributing Vidar, StealC, Remcos, SnappyClient, Arechclient2, CryptBot, and other commodity or MaaS payloads. Recent reporting also noted re-emergent Carbanak activity delivered through HijackLoader, indicating its continued utility as a modern delivery mechanism for older but still operational malware families.
On infected systems, HijackLoader has demonstrated strong defense-evasion tradecraft, including binary bloating, in-memory assembly of components, abuse of signed binaries for sideloading, and deployment patterns intended to frustrate sandboxing and forensic recovery. Some observed chains also established persistence for follow-on payloads. Overall, HijackLoader is best understood as a versatile loader-as-a-service framework optimized for stealthy Windows payload delivery and post-compromise flexibility.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The observed format is consistent with HijackLoader , also tracked as IDATLoader . The IDAT container is therefore not an isolated packer trick. It belongs to a wider modular loader framework that can deploy different components and final payloads depending on its configuration.
The observed format is consistent with HijackLoader , also tracked as IDATLoader . The IDAT container is therefore not an isolated packer trick. It belongs to a wider modular loader framework that can deploy different components and final payloads depending on its configuration.
The infrastructure graph generated from the correlation of indicators identified in the campaign reveals a complex network of relationships... through this, we note similarities with the already well-known “HijackLoader.”
“...EncryptHub added to the game files the HijackLoader malware (CVKRUTNP.exe), which establishes persistence on the victim device and downloads the Vidar infostealer (v9d9d.exe).”
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Rhadamanthys is an infostealer distributed via malspam and malvertising. Google searches for popular software such as Notion return malicious ads. Threat actors are using decoy websites to trick users into downloading malware.
Threat actors are abusing fake Google and Cloudflare verification pages in evolving ClickFix campaigns to socially engineer users into executing malicious commands on their own systems.
a user was tricked into running a malicious PowerShell command
The Blackpoint SOC received alerts for suspicious powershell.exe usage by a user who fell for a ClickFix-style (Win+R) attack.
The module names expose the frameworks modular design... custom injection. The final carved PE is a legitimate copy of HearthstoneDeckTracker.exe. Its placement within the bundle suggests that it may be used as a host process for the loaders CUSTOMINJECT execution path.
This is a standard way to keep recognizable strings like CreateFileW or VirtualProtect out of the binary
The PowerShell command drops and extracts a large archive (exceeding 120 MB) containing multiple files. This is a well-known binary bloating technique designed to evade static analysis and automated sandbox scanning.
the file is a steganographic container, with its contents stored as a stream of PNG image chunks
The first thing it does is resolve the Windows APIs it needs by carrying a small numeric hash for each API name, walking the export table of kernel32.dll at runtime
The larger physicsdesc.map file is approximately 1.36 MB... The file is not a valid image, but enough of the internal PNG chunk structure is retained for the shellcode to parse it.
The module names expose the frameworks modular design... custom injection. The final carved PE is a legitimate copy of HearthstoneDeckTracker.exe. Its placement within the bundle suggests that it may be used as a host process for the loaders CUSTOMINJECT execution path.
Vidar is decrypted in memory and injected, through process hollowing, into a clean, signed third-party application
The trojanized library then reads an innocuous-looking data file, decrypts it, and produces a block of shellcode
a trusted, signed program loads a malicious library from its own directory, so the attacker’s code ends up running inside a process that every reputation and signature check considers benign
155 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
53 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loader used to deploy additional payloads after initial execution.
HijackLoader6
Loader malware distributed via fake Google and Cloudflare verification pages as part of ClickFix social-engineering campaigns.
A modern loader family used to deliver Carbanak in 2024-2025.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.