Loading story…
SnappyClient is a C++ command-and-control implant used to maintain persistent access, remotely control infected systems, and steal data, including information from browsers, applications, extensions, and crypto wallets. Research from Zscaler ThreatLabz and follow-on reporting show the malware supports capabilities such as screenshot capture, keylogging, remote shell access, and broad data exfiltration, while also using multiple evasion techniques to reduce detection. Those techniques include an AMSI bypass, 64-bit execution support, direct system calls, and code injection into legitimate processes.
Observed delivery chains used HijackLoader to deploy SnappyClient, including campaigns involving a fake Telefónica/O2 website targeting German-speaking users and additional intrusions linked to ClickFix and GhostPulse-style activity. Zscaler's analysis also found the malware stores a plaintext JSON configuration in the binary and uses hooks on LoadLibraryExW, AmsiScanBuffer, and AmsiScanString to force clean AMSI results. The reporting indicates SnappyClient emerged in late 2025 and is notable as a flexible, stealth-oriented implant that combines remote administration, surveillance, and theft functions in a single framework.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
A SnappyClient version 0.1.22 sample compiled on April 2, 2026 used a 32-bit intermediary loader delivered by HijackLoader to unpack and self-hollow the RAT payload. Reverse engineering found matching runtime structures, CRC-32 code, configuration format, API-resolution order, syscall logic, and dead code, supporting the conclusion that the loader was compiled from HijackLoader source code; later 0.1.29 versions were loaded directly by HijackLoader.
On March 18, 2026, Zscaler ThreatLabz published a technical analysis detailing SnappyClient's capabilities, including AMSI bypass, persistence, encrypted custom TCP command-and-control, browser and wallet theft, keylogging, screenshots, remote shell access, and reverse proxy features. The researchers assessed the operation as financially motivated and focused on cryptocurrency theft, and noted code and tradecraft overlaps with HijackLoader suggesting a possible link between the malware families.
ThreatLabz observed SnappyClient being delivered through HijackLoader in multiple intrusion chains, including a fake Telefónica/O2 website targeting German-speaking users and a ClickFix-based GhostPulse/HijackLoader infection flow. These delivery methods showed operators using varied social engineering and loader-based distribution tactics.
Zscaler ThreatLabz reported that the SnappyClient malware family was first seen in December 2025. It was identified as a modular command-and-control implant used for stealthy persistence, surveillance, remote access, and data theft.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
neso.re
Open sourcezscaler.com
Open sourcedarkreading.com
Open sourceinfosec.pub
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple threat reports describe **ClickFix-style social engineering** and related Windows loader chains that trick users into launching malicious PowerShell or staged binaries, culminating in **memory-resident malware**. In one campaign, a fake CAPTCHA coerces victims into running PowerShell that fetches a first-stage script, injects a .NET loader into `powershell.exe`, and launches a **Donut 0.9.3** shellcode package entirely in memory to deploy an infostealer targeting Firefox data, Chromium cookies, and screenshots. Separate reporting also tied ClickFix activity to **HijackLoader**-based stealer delivery and to a campaign abusing signed **Mozilla Firefox** binaries for **DLL sideloading** of **KongTuke**, with Rust-based DLL variants handling loading, persistence, and command-and-control. Another analyzed infection chain used a heavily obfuscated batch-script loader that rebuilt embedded payloads, renamed PowerShell to `HDVz.exe`, staged files under `C:\ProgramData\IntelDriver`, and created a scheduled task for logon persistence before injecting Donut shellcode into `explorer.exe`. That malware tampered with **AMSI** and **ETW**, used a custom memory marker `DE AD BE CA FE BA EF` to avoid duplicate injection, and sent execution notifications through the **Telegram Bot API** while attempting outbound communication to `167.88.167.9:8356`. Across the reporting, the common pattern is the use of **trusted binaries, in-memory execution, shellcode loaders, and evasive tradecraft** to steal data or maintain access while minimizing disk artifacts and frustrating endpoint detection.
Aug 15, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers reported that **Amadey** has evolved from an information-stealing bot into a broader malware delivery platform, with newer variants adding screenshot capture, expanded credential theft, clipboard hijacking, and delivery of follow-on payloads such as **Remcos RAT**, **RedLine Stealer**, and **LockBit 3.0**. Recent analyses said the malware is being distributed through multiple channels including the **RIG Exploit Kit**, phishing emails, fake software installers, torrent-distributed cracks and keygens, malicious Office documents, and gaming cheat sites. Once executed, Amadey typically profiles the host, checks for security products, establishes persistence through registry changes, scheduled tasks, or startup-folder abuse, and communicates with command-and-control servers over plain HTTP to fetch plugins and additional malware. Multiple reports said Amadey operators are using modular DLL components such as `cred.dll`, `scr.dll`, `clip64.dll`, and newer credential-stealing plugins to harvest browser, remote access, FTP, Outlook, and MikroTik data while also capturing screenshots and replacing cryptocurrency wallet addresses in the clipboard. Long-term infrastructure tracking found hundreds of active Amadey C2 servers and thousands of secondary payloads, showing that the malware has become a durable **loader-as-a-service** platform with ties to overlapping criminal campaigns. Analysts also observed delivery chains involving SmokeLoader and Nitol, abuse of public-interest lures such as fake KakaoTalk updates, and continued use of Amadey to stage ransomware and remote-access infections on compromised Windows systems.
Aug 15, 2026