Infostealer and Loader Malware Activity Targeting Windows Users

Multiple reports highlight active Windows-focused malware operations centered on credential theft and payload delivery. Socelars is described as a stealthy infostealer that prioritizes harvesting browser-stored session cookies and authentication artifacts (notably targeting Facebook Ads Manager sessions) to enable account takeover and fraud; it is reportedly distributed via fake websites posing as legitimate software (e.g., a PDF reader) and uses staged execution including system reconnaissance and a UAC bypass via COM auto-elevation before extracting browser session data for exfiltration.

Separately, research details how established malware delivery ecosystems are evolving. Zscaler ThreatLabz reports GuLoader (CloudEye) increasingly abuses legitimate cloud services (e.g., Google Drive and OneDrive) to blend malicious downloads into normal traffic, while using polymorphism and control-flow obfuscation plus layered decryption to hinder analysis and deliver follow-on payloads such as RATs and stealers. Bitdefender reports a resurgence of LummaStealer despite prior law-enforcement disruption, attributing continued scale to social-engineering-heavy distribution (fake cracks/downloads and fake CAPTCHA/“ClickFix” lures) and the use of CastleLoader for modular, in-memory execution and obfuscated delivery; the report notes infrastructure overlap suggesting coordination or shared providers. A separate Unit 42 incident-response writeup on Muddled Libra (Scattered Spider/UNC3944) describes a distinct intrusion tradecraft involving unauthorized access to a VMware vSphere environment and a rogue VM used for reconnaissance, persistence, and interaction with enterprise infrastructure, and is not part of the infostealer/loader activity described in the other items.