New Windows Loaders Use APC Injection, ClickFix, and WebDAV to Deploy RATs

Researchers reported two newly documented Windows malware loaders, Kiss Loader and DeepLoad, in emerging campaigns that rely on stealthy execution and social engineering to deliver follow-on malware. G DATA said Kiss Loader was delivered through phishing emails using Internet Shortcut (.url) files disguised as PDFs, which retrieved payloads through a TryCloudflare tunnel and an exposed WebDAV repository. The loader established persistence, showed a decoy PDF, downloaded additional components, and deployed malware including VenomRAT and a .NET Reactor-protected sample identified as Kryptik.

DeepLoad was distributed through the ClickFix technique, tricking victims into pasting malicious PowerShell into the Windows Run dialog before launching mshta.exe and obfuscated PowerShell to execute the infection chain. Researchers said the malware used APC injection, AI-assisted obfuscation, randomized Add-Type DLL compilation, PowerShell history suppression, abuse of legitimate processes such as LockAppHost.exe, and WMI event subscriptions for persistence and reinfection. Its objectives included browser credential theft, deployment of a malicious browser extension to capture logins, and propagation through removable media with deceptive .lnk filenames, while Kiss Loader similarly used Early Bird APC injection into explorer.exe to evade detection and run payloads in memory.