Loading malware…
LoadLoop is a malware loader associated with Sandworm activity, including campaigns attributed to the CERT-UA cluster UAC-0145 targeting Ukraine in 2026. It has been observed as part of a broader intrusion set delivered through ClickFix-style social engineering in which compromised websites display fake CAPTCHA or verification prompts that trick victims into executing malicious PowerShell commands on Windows systems. In these operations, LoadLoop appeared alongside other Sandworm tooling such as GHETTOVIBE, SCOUTCURL, FLUIDLEECH, and the Python backdoor FREAKYPOLL.
Within the observed infection chains, LoadLoop functioned as a follow-on payload used after initial compromise and reconnaissance, particularly on systems assessed as valuable. Its role as a loader indicates use for staging or executing additional malicious components to extend attacker access and support persistent operations. The surrounding campaigns combined user-executed PowerShell, reconnaissance, persistence mechanisms, and subsequent deployment of additional malware, consistent with targeted post-compromise tradecraft.
LoadLoop has been reported in operations focused on Ukrainian targets and linked to Russian state-sponsored intrusion activity associated with Sandworm, also tracked as UAC-0002, APT44, and Seashell Blizzard. High-confidence reporting supports Windows as the relevant platform in the documented ClickFix delivery chains.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
If the target was valuable, the threat actors used other malware samples to gain persistent access to the system. For example, FluidLeech, a fake antivirus software, and LoadLoop, a loader, were also used in the attacks.
...payloads such as FLUIDLEECH, LOADLOOP, and the Python backdoor FREAKYPOLL.
Серед лоадерів також відмічено використання програмних засобів FLUIDLEECH ... та LOADLOOP.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
...набули поширення випадки розповсюдження програмних засобів реалізації кіберзагроз у месенджері Signal під виглядом необхідності встановлення "антивірусного захисту".
Victims visiting compromised websites are presented with a fake CAPTCHA security check and instructed to copy and paste a PowerShell command into their Windows computers.
That extra step is the infection.
Researchers also observed two malware loaders: FluidLeech, disguised as antivirus removal software, and LoadLoop.
The commands downloaded Visual Basic scripts and other malicious files, which in turn deployed several malware families known to be used by Sandworm.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.