Loading malware…
GHOSTPULSE, also known as HijackLoader and IDATLoader, is a multi-stage Windows malware loader active since 2023. It is designed to decrypt, stage, and inject final payloads while evading endpoint detection. Observed payloads include SectopRAT/ArechClient2, Lumma Stealer, Rhadamanthys, Vidar, RedLine, and NetSupport RAT. The loader has been distributed in malicious signed MSIX packages impersonating legitimate software, as well as MSI, executable, ISO, and DLL-sideloading infection chains. Campaigns have used SEO poisoning, malvertising, compromised websites, and ClickFix fake-CAPTCHA lures that induce victims to execute clipboard-delivered PowerShell commands. GHOSTPULSE commonly abuses DLL sideloading, module stomping, direct NT API invocation, cross-process injection, and Process Doppelgänging. It can establish shortcut-based persistence and uses encrypted configuration and payload data concealed in image-related structures, evolving from PNG IDAT chunks to pixel data and headerless IDAT-style containers. Some activity is consistent with FakeBat-linked MSIX operations, but a distinct operator attribution for GHOSTPULSE is not established.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
Victims are typically lured through malicious advertising or SEO poisoning campaigns, believing they are downloading legitimate software such as Grammarly, Microsoft Teams, Notion, or Zoom.
Victims are typically lured through malicious advertising or SEO poisoning campaigns, believing they are downloading legitimate software such as Grammarly, Microsoft Teams, Notion, or Zoom.
Users are suspected to be directed to download malicious MSIX packages through compromised websites, SEO techniques, or malvertising.
The infection chain begins with a phishing page that imitates a Cloudflare anti-DDoS Captcha verification.
The malicious captcha page was hosted under two domains ... under the URI /captcha and /Client.
The malware then initiates a suspended child process using the executable specified in the Stage 2 configuration, which is a 32-bit cmd.exe in this case.
The user is instructed to copy a seemingly harmless 'fix' (which is a malicious PowerShell command) and paste it directly into their operating system's run dialog.
Stage 2 reads ntdll.dll from disk, obtains NT API offsets, and directly invokes the APIs to evade userland hooks set by security products.
“In 2025, Elastic Security Labs documented a campaign in which a threat actor used the Ghostpulse malware loader to deliver SectopRAT following a ClickFix social-engineering attack.”
User interaction on this page initiates execution.
“a new campaign leveraging defense evasion capabilities to infect vicitms with malicious MSIX executables.”
To achieve this, the malware leverages COM (Component Object Model) objects as part of its technique.
The malware then initiates a suspended child process using the executable specified in the Stage 2 configuration, which is a 32-bit cmd.exe in this case.
GHOSTPULSE has the ability to establish persistence, if configured to, by generating an .lnk file that points to the Stage 1 binary, denoted as VBoxSVC.exe.
“GHOSTPULSE ... decrypts and injects its final payload to evade detection.”
The primary thread’s execution is then redirected to the malicious code in mshtml.dll with the Wow64SetThreadContext API.
Shellcode contained inside the decrypted blob is written to the .text section of freshly loaded mshtml.dll and then executed; this is known as module stomping.
GHOSTPULSE employs Process Doppelgänging, leveraging NTFS transactions to inject the final payload into a new child process.
The malware then initiates a suspended child process using the executable specified in the Stage 2 configuration, which is a 32-bit cmd.exe in this case.
GHOSTPULSE has the ability to establish persistence, if configured to, by generating an .lnk file that points to the Stage 1 binary, denoted as VBoxSVC.exe.
“The extractor takes as input the encrypted file shipped with GHOSTPULSE which contains it's different stages and the final payload.”
“Instead of extracting the payload from the IDAT chunk, the latest version of GHOSTPULSE now parses the pixels of the image to retrieve its configuration and payload.”
This is done to evade userland hooks set by security products.
Stage 1 and Stage 2 build Import Address Tables, using custom API-name hashing algorithms; Stage 2 uses CRC32.
“Now, the entire package consists of a single file—a benign but compromised executable that includes the PNG file within its resources section.”
The encrypted data is stored in chunks in handoff.wav, while the final payload and configuration are encrypted and XOR-decrypted at runtime.
Observed masquerading themes include installers for Chrome, Brave, Edge, Grammarly, and WebEx. VBoxSVC.exe is actually a renamed signed gup.exe executable.
Defense Evasion Masquerading T1036.005 Legitimate iMyFone binary with valid (expired) EV cert
“GHOSTPULSE ... decrypts and injects its final payload to evade detection.”
The primary thread’s execution is then redirected to the malicious code in mshtml.dll with the Wow64SetThreadContext API.
Shellcode contained inside the decrypted blob is written to the .text section of freshly loaded mshtml.dll and then executed; this is known as module stomping.
GHOSTPULSE employs Process Doppelgänging, leveraging NTFS transactions to inject the final payload into a new child process.
During stage 1 of the loader, it decrypts the file using a DWORD addition operation ... The loader then decrypts [the] encrypted ARECHCLIENT2 sample.
Execution Windows Installer T1218.007 MSI deploys payload via msiexec
“Elastic Security Labs has observed a campaign to compromise users with signed MSIX application packages to gain initial access.”
Defense Evasion Debugger Evasion T1622 IsDebuggerPresent checks in trojanized DLL
The campaign compromises users with signed MSIX application packages; MSIX requires purchased or stolen code-signing certificates.
The malware executes a function that checks for a list of processes to see if they are running.
Additionally, it has the capability to disable redirection of the file system to WOW64, achieved through the utilization of the procedure Wow64FsRedirection, if configured to do so.
Defense Evasion Debugger Evasion T1622 IsDebuggerPresent checks in trojanized DLL
“This leads to a PowerShell script being executed, initiating the infection chain by downloading and executing a GHOSTPULSE payload.”
Command and Control Encrypted Channel T1573 HTTPS C2 communication
56 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.