Loading story…
Researchers reported two newly documented Windows malware loaders, Kiss Loader and DeepLoad, in emerging campaigns that rely on stealthy execution and social engineering to deliver follow-on malware. G DATA said Kiss Loader was delivered through phishing emails using Internet Shortcut (.url) files disguised as PDFs, which retrieved payloads through a TryCloudflare tunnel and an exposed WebDAV repository. The loader established persistence, showed a decoy PDF, downloaded additional components, and deployed malware including VenomRAT and a .NET Reactor-protected sample identified as Kryptik.
DeepLoad was distributed through the ClickFix technique, tricking victims into pasting malicious PowerShell into the Windows Run dialog before launching mshta.exe and obfuscated PowerShell to execute the infection chain. Researchers said the malware used APC injection, AI-assisted obfuscation, randomized Add-Type DLL compilation, PowerShell history suppression, abuse of legitimate processes such as LockAppHost.exe, and WMI event subscriptions for persistence and reinfection. Its objectives included browser credential theft, deployment of a malicious browser extension to capture logins, and propagation through removable media with deceptive .lnk filenames, while Kiss Loader similarly used Early Bird APC injection into explorer.exe to evade detection and run payloads in memory.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers disclosed a separate malware campaign distributing a previously undocumented loader named DeepLoad via the ClickFix social engineering technique. The malware used obfuscated PowerShell, mshta.exe, APC injection, removable-media propagation, and WMI event subscriptions to steal browser credentials and maintain persistence.
While investigating Kiss Loader, G DATA reported direct interaction with the threat actor, who confirmed that the use of Early Bird APC injection was intentional. This provided rare confirmation of the operator's deliberate evasion design.
During analysis of the March 2026 campaign, researchers found Kiss Loader fetching payloads through a TryCloudflare tunnel and an exposed WebDAV repository, then establishing persistence, showing a decoy PDF, and deploying malware including VenomRAT and a Kryptik sample. Its primary evasion technique was Early Bird APC injection into explorer.exe using Donut-generated shellcode.
G DATA identified a newly discovered malware loader called Kiss Loader and said the campaign was first observed in early March 2026. The operation used phishing-delivered Windows Internet Shortcut files disguised as PDFs to target Windows users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ReliaQuest researchers reported that a credential-stealing malware campaign dubbed **DeepLoad** has been compromising enterprise IT environments through **ClickFix/QuickFix-style social engineering**. Attackers used fake browser prompts and error pages to trick users into running a malicious command, which launched a loader engineered to bypass multiple security tools. Researchers said the malware used heavily padded code and execution tied to a Windows lock-screen process, indicating **AI-assisted obfuscation at multiple stages** to reduce the effectiveness of static, file-based detection. Once installed, DeepLoad enabled **real-time keylogging**, stole credentials, spread to connected USB drives, and maintained hidden persistence that allowed the malware to re-execute days after apparent cleanup. The campaign's ability to survive standard remediation has raised concern that AI-generated variation is making malware more adaptable and harder to detect. Researchers urged defenders to emphasize **behavioral and runtime detection** over traditional static analysis to identify similar threats earlier.
Jun 29, 2026
Multiple reports detail **distinct, unrelated malware families and delivery chains** rather than a single shared incident. One analysis covers **NotOpenClaw**, a Windows malware loader distributed via **fake “OpenClaw” installers** (including GitHub-hosted lures) and emphasizing **VM/sandbox evasion**; the sample analyzed was tagged with stealer-related indicators (e.g., VidarStealer) and was previously referenced in third-party reporting about fake OpenClaw installers deploying additional malware. Separate research describes two different fileless/backdoor operations: **HellsUchecker**, a small native x64 backdoor delivered through a **10-stage chain** beginning with a **ClickFix** fake Cloudflare CAPTCHA that tricks users into pasting an obfuscated Run command, using a LOLBin to fetch payloads over **finger (TCP/79)** and retrieving encrypted C2 configuration from a **BNB Smart Chain** smart contract ("EtherHiding"), culminating in an **in-memory** final payload using **Hell’s Gate** direct syscalls; and **GhostWeaver**, a **fileless PowerShell RAT** that selects persistence based on the installed AV product, uses **TLS over TCP/25658**, and relies on multiple **DGA** routines for delivery and C2. A separate brief reports the **VOID#GEIST** campaign delivering **XWorm**, **AsyncRAT**, and **Xeno RAT** via phishing, batch scripts from **TryCloudflare** domains, staged ZIP payloads, Python-based decryption/execution, and abuse of `AppInstallerPythonRedirector.exe` to facilitate additional RAT deployment.
Jun 29, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026