Loading malware…
PowerLoader is a name associated with Windows malware loaders and downloaders. Historical PowerLoader 2.0 is notable for injecting code into Windows Explorer using Extra Window Memory Injection. It places shellcode in existing shared memory, manipulates Explorer's window data, and redirects execution through legitimate executable code and a return-oriented programming chain. This approach avoids remote memory allocation and new-thread creation during injection and enables payload execution despite Data Execution Prevention. Similar injection techniques have appeared in Carberp, Redyms, and Gapz.
The PowerLoader name was also used for a C++ downloader deployed by Fluffy Wolf in phishing campaigns against Russian organizations between March and May 2026. Marketed through malware-as-a-service offerings, this downloader operates largely filelessly, launches hidden PowerShell instances, retrieves scripts from command-and-control infrastructure, and downloads and executes PureCrypter to deliver subsequent payloads. Campaign payloads included PureLogs, PureRAT, and Pay2Key ransomware. Distribution used business-themed phishing emails impersonating partners or contractors, with malicious archives attached directly or supplied through GitHub repository links. Targeted sectors included construction, consulting, manufacturing, engineering, retail, and e-commerce.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
PowerLoader is an undocumented C++ downloader that executes almost entirely filelessly to bypass standard endpoint defenses like Windows Defender.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Security researchers have uncovered a series of highly sophisticated Fluffy Wolf phishing attacks targeting Russian organizations across various critical sectors.
Using highly deceptive tactics, the attackers send emails masquerading as legitimate corporate communications regarding outstanding debts, reconciliation statements, or legal claims. To bypass modern email security gateways, the attackers heavily rely on malicious RAR attachments...
Fluffy Wolf uses GitHub repository URLs in phishing emails. Because such links appear legitimate, they help the attackers bypass email filtering and network security controls while increasing the likelihood that recipients will open them.
Once PowerLoader infiltrates a target host, it spawns hidden PowerShell instances to retrieve additional malicious scripts directly from the command-and-control (C2) server.
EXTRA WINDOW MEMORY INJECTION (EWMI) VIA SETWINDOWLONG EWMI relies on injecting into Explorer tray window’s extra window memory... | Process injection is a widespread defense evasion technique employed often within malware and fileless adversary tradecraft, and entails running custom code within the address space of another process.
EXTRA WINDOW MEMORY INJECTION (EWMI) VIA SETWINDOWLONG EWMI relies on injecting into Explorer tray window’s extra window memory... | Process injection is a widespread defense evasion technique employed often within malware and fileless adversary tradecraft, and entails running custom code within the address space of another process.
Once PowerLoader infiltrates a target host, it spawns hidden PowerShell instances to retrieve additional malicious scripts directly from the command-and-control (C2) server. These scripts systematically deploy the final payloads...
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.