Loading malware…
DOILoader, also referred to in the provided content as IDAT Loader or HijackLoader, is a malware loader used to execute encrypted follow-on payloads via DLL side-loading. In the observed activity, threat actors bundled trojanized DLLs with legitimate signed applications so that execution of the benign program side-loaded DOILoader, which then decrypted and launched the next-stage malware from an included encrypted file. Reported examples include a trojanized PYTHON27.DLL side-loaded by a renamed legitimate Ace Stream executable to execute an encrypted payload in Vos.xwtx and run zgRAT, and a trojanized DLL bundled with the signed application Rene.E Facebook Widget to load Lumma Stealer encoded in an m4a file. Proofpoint also described ClearFake activity in which a trojanized DLL using DOILoader loaded Lumma Stealer from an encrypted file extracted from a ZIP archive.
The malware is associated in the content with multiple financially motivated delivery clusters and campaigns. It was observed in malware chains tied to TA2727, where Windows users were typically served DOILoader and Lumma Stealer through fake browser update lures on compromised websites, with traffic routed by TA2726. It also appeared in broader activity sets that delivered XWorm, Amadey, zgRAT, NetSupport, and Lumma Stealer, including reservation-themed DanaBot-linked campaigns and Lovable-hosted malware delivery chains. Infection vectors directly mentioned include fake secure download pages, fake browser update pages, compromised websites with malicious injects, and archives containing legitimate executables plus trojanized DLL dependencies.
High-confidence indicators and artifacts directly mentioned in the content include the encrypted payload file Vos.xwtx, the trojanized PYTHON27.DLL, bundled m4a-encoded payload storage, and one command-and-control endpoint associated with a DOILoader-to-zgRAT chain: 84[.]32[.]41[.]163:7705.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The MSI installed and executed the legitimate and signed application “Rene.E Facebook Widget”. However, one of the bundled DLLs was trojanized with DOILoader, which was side loaded upon execution. DOILoader then ran Lumma Stealer, which was encoded in a bundled m4a file.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Typically, an attack chain will consist of three parts: the malicious injects served to website visitors, which are often malicious JavaScript scripts; a traffic distribution service (TDS) responsible for determining what user gets which payload based on a variety of filtering options; and the ultimate payload that is downloaded by the script.
Messages contained URLs leading to a website instructing the recipient to sign a form and click “submit”. Then, the user would be redirected to a ClickFix landing page.
If the target clicked the download button, a popup opened that provided the password “RE2025” and another download button that led to the download of a RAR-file...
The RAR file contained the executable “Rechnung DE009100019000.exe”... When the .exe was executed, it sideloaded the included PYTHON27.DLL...
The MSI installed and executed the legitimate and signed application “Rene.E Facebook Widget”. However, one of the bundled DLLs was trojanized with DOILoader, which was side loaded upon execution.
downloaded a file named “data.zip” and extracted the contents to find and execute any .exe files
another download button that led to the download of a RAR-file “DE0019902001000RE.rar” hosted on Dropbox.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.