Loading malware…
GHOSTPULSE, also known as HIJACKLOADER and IDATLOADER, is a multi-stage Windows malware loader active since 2023. It is designed to decrypt, stage, and inject follow-on payloads while using layered defense-evasion techniques. Observed payloads include information stealers and remote-access trojans, including Lumma Stealer, Rhadamanthys, Vidar, SectopRAT/ArechClient2, and NetSupport RAT.
GHOSTPULSE has been delivered through malicious code-signed MSIX packages masquerading as legitimate software installers, as well as MSI, executable, and ISO-based chains. These campaigns have used compromised websites, search-engine optimization poisoning, malvertising, and ClickFix-style fake CAPTCHA lures. ClickFix delivery persuades victims to execute clipboard-injected PowerShell commands that download a DLL-sideloading package containing the loader.
The loader commonly abuses DLL sideloading to execute from a trojanized library loaded by a legitimate signed application. Its staged content has been concealed in encrypted data embedded in PNG IDAT chunks, headerless IDAT-like structures, or image pixel data. GHOSTPULSE decrypts and decompresses these components, resolves APIs dynamically through hashing, and can use module stomping, direct NT API invocation, Heaven's Gate, process injection, and Process Doppelgänging to execute payloads and reduce visibility to user-mode security products. Some variants establish persistence through shortcut-based startup execution and use host-derived encryption and environment variables to pass data between stages. Activity using GHOSTPULSE has been observed with tradecraft consistent with FakeBat operations and campaigns linked by Microsoft reporting to Storm-1113.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
The malware then initiates a suspended child process using the executable specified in the Stage 2 configuration, which is a 32-bit cmd.exe in this case.
The user is instructed to copy a seemingly harmless 'fix' (which is a malicious PowerShell command) and paste it directly into their operating system's run dialog.
Stage 2 reads ntdll.dll from disk, obtains NT API offsets, and directly invokes the APIs to evade userland hooks set by security products.
This social engineering technique tricks users into copying and pasting malicious PowerShell that results in malware execution.
“GHOSTPULSE ... decrypts and injects its final payload to evade detection.”
The primary thread’s execution is then redirected to the malicious code in mshtml.dll with the Wow64SetThreadContext API.
Shellcode contained inside the decrypted blob is written to the .text section of freshly loaded mshtml.dll and then executed; this is known as module stomping.
GHOSTPULSE employs Process Doppelgänging, leveraging NTFS transactions to inject the final payload into a new child process.
“The extractor takes as input the encrypted file shipped with GHOSTPULSE which contains it's different stages and the final payload.”
“Instead of extracting the payload from the IDAT chunk, the latest version of GHOSTPULSE now parses the pixels of the image to retrieve its configuration and payload.”
This is done to evade userland hooks set by security products.
Stage 1 and Stage 2 build Import Address Tables, using custom API-name hashing algorithms; Stage 2 uses CRC32.
“Now, the entire package consists of a single file—a benign but compromised executable that includes the PNG file within its resources section.”
The encrypted data is stored in chunks in handoff.wav, while the final payload and configuration are encrypted and XOR-decrypted at runtime.
Observed masquerading themes include installers for Chrome, Brave, Edge, Grammarly, and WebEx. VBoxSVC.exe is actually a renamed signed gup.exe executable.
“GHOSTPULSE ... decrypts and injects its final payload to evade detection.”
The primary thread’s execution is then redirected to the malicious code in mshtml.dll with the Wow64SetThreadContext API.
Shellcode contained inside the decrypted blob is written to the .text section of freshly loaded mshtml.dll and then executed; this is known as module stomping.
GHOSTPULSE employs Process Doppelgänging, leveraging NTFS transactions to inject the final payload into a new child process.
55 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader delivered through a trojanized Qt5Network.dll via DLL sideloading. It activates in DllMain, reads encrypted payload and config files, parses IDAT chunk data from a fake XML container, extracts the XOR key from the config, decrypts the payload, and injects DeerStealer into memory. The sample uses headerless PNG IDAT chunk framing rather than a valid PNG image.
Payload concealment and delivery technique/tool using PNG IDAT chunk structure to hide custom-encrypted shellcode. In this chain it is used to store and deliver the encrypted payload processed by HijackLoader.
With the release of v0.16, here are the different malware families that we cover. blister deprecated ghostpulse latrodectus lobshot lumma netwire redlinestealer remcos smokeloader stealc strelastealer xorddos
Referenced only as a malware family supported by the nightMARE analysis library; no behavior is described.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.