Loading story…
Researchers detailed OnionDrop, a high-severity multi-stage malware loader being used to deliver information-stealing malware at scale, including LegionLoader (also called CurlyGate), CGrabber, and Vidar Stealer. The malware is described as unusually sophisticated for a commodity operation, with reporting from multiple security firms highlighting engineering and tradecraft more commonly associated with higher-end threat activity.
Analysis shows OnionDrop uses a layered infection chain and multiple stealth mechanisms to hinder detection and reverse engineering, including DLL sideloading, layered decoding and decryption, dynamic API resolution, anti-analysis checks, and shellcode execution through Windows Thread Pool callbacks. Defenders were provided with threat-hunting material including an associated URL indicator and multiple SHA-256 hashes to support detection of the loader and related payloads.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Gurucul published threat research on OnionDrop, detailing its use in distributing LegionLoader, CGrabber, and Vidar Stealer and providing one URL indicator plus nine SHA-256 hashes for detection and hunting.
Cyderes published an analysis describing OnionDrop as a sophisticated multi-stage malware loader used to deliver information-stealing payloads and employing advanced evasion and execution techniques.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how **SmokeLoader** continues to operate as a heavily obfuscated, multi-stage malware loader that hides its execution flow and decrypts later payloads in memory before contacting command-and-control infrastructure. Reverse-engineering of recent samples showed opaque predicate obfuscation, encrypted functions, API hashing based on `djb2` with an added XOR layer, and a compressed third stage that is decrypted with XOR keys before being unpacked with **LZSA2**. Analysts also reported that the final decrypted stage can have a damaged PE header while retaining usable sections, complicating static analysis but still allowing recovery of configuration data such as RC4-encrypted strings and multiple C2 URLs. Separate analysis traced a Visual Basic Script infection chain that used `wscript.exe` to launch an obfuscated PowerShell downloader, which then fetched an executable from `americanocoffea[.]ru` into the victim's temp directory and executed it as a SmokeLoader payload. One investigated sample was observed delivering the **Vidar** infostealer, reinforcing SmokeLoader’s role as a malware distribution platform rather than a single-purpose implant. Public research from CERT Polska and independent analysts collectively highlights SmokeLoader’s layered packing, staged delivery, and reusable infrastructure as key factors that make the malware effective for initial access and follow-on payload deployment.
Aug 15, 2026
Zscaler ThreatLabz identified **2CLoader**, a Windows malware loader observed in August 2026 delivering the Vidar and Remus information stealers and, in some cases, the XWorm RAT. The loader stores its configuration and encrypted payloads in PE resources, then applies layered rolling XOR, incremental XOR, AES-256-GCM encryption, SHA-256-derived key material, and optional Xpress Huffman decompression before execution. It supports in-memory .NET execution, manual PE loading, and RunPE/process hollowing. 2CLoader uses Hell’s Gate-style indirect system calls, anti-debugging and anti-VM checks, user-activity validation, single-instance locking, and optional API trampoline hooks to hinder analysis and alter environment information. It can persist through per-user Registry entries, Startup-folder placement, and scheduled tasks, while communicating with HTTP command-and-control infrastructure through XOR-encrypted JSON telemetry. Organizations should hunt for these persistence mechanisms and suspicious processes performing resource-based payload decryption, memory-only .NET loading, or process hollowing.
Sep 30, 2026
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026