Loading story…
A recent phishing campaign is delivering LokiBot through malicious email attachments containing obfuscated JScript, reviving the long-running infostealer with a multi-stage infection chain designed to evade detection. The script runs via Windows Script Host, decodes a PowerShell loader, and decrypts a ConfuserEx-protected .NET injector that reflectively loads into memory before injecting the final payload into aspnet_compiler.exe using Windows APIs including CreateProcessA, VirtualAllocEx, WriteProcessMemory, SetThreadContext, and ResumeThread.
Once executed, the 32-bit LokiBot payload uses API hashing and runtime API resolution, creates a mutex derived from the victim system's MachineGuid, steals credentials from numerous applications, compresses the data with aPLib, and beacons to HTTP command-and-control servers roughly every minute. Researchers said the malware stores C2 addresses with 3DES encryption and noted a flawed persistence mechanism in some newer builder-generated samples, where a patched decryption routine causes the malware to use a C2 URL instead of the intended Run registry path; reported infrastructure includes the IP address 158.94.211.95, and defenders were urged to block script-based attachments and watch for abnormal aspnet_compiler.exe activity.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
The reporting says a 2018 source-code leak helped expand LokiBot's reach and development, contributing to its continued use.
The reporting states that LokiBot was first advertised in 2015, marking its emergence as a malware offering.
The analysis found that newer builder-generated samples contained a flawed persistence routine in which a patched decryption function caused the malware to use a C2 URL instead of the intended Run registry path.
LevelBlue reported a recent phishing-driven LokiBot campaign using an obfuscated JScript attachment, a PowerShell loader, a ConfuserEx-protected .NET injector, and process injection into aspnet_compiler.exe to deploy the final payload.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple security reports documented **LokiBot/Loki Info Stealer** campaigns delivered through phishing emails that used a wide range of attachment types and exploit chains, including **LZH**, **ACE**, **RAR**, **PDF**, **DOCX**, **RTF**, and Excel-based lures. The messages commonly impersonated business documents such as payment confirmations, invoices, shipment notices, and purchase orders, while some samples abused PDF `OpenAction`, embedded URI actions, malicious macros, or exploits including **`CVE-2016-0189`**, **`CVE-2017-11882`**, **`CVE-2021-40444`**, and **`CVE-2022-30190`** to download or launch the malware. Researchers also observed compromised infrastructure hosting downloaders and payloads, along with HTTP POST traffic to attacker-controlled command-and-control endpoints. Once executed, LokiBot used layered evasion and execution techniques such as **process hollowing**, shellcode loaders, API hashing, anti-debugging, anti-VM checks, obfuscation, and in-memory decryption to avoid detection. The malware established persistence in user profile and startup locations, hid files under `%APPDATA%`, and stole credentials and data from browsers, FTP clients, email applications, password managers, Windows credentials, Microsoft Outlook registry entries, and even user files such as Stickies notes. Stolen information was compressed and exfiltrated over HTTP, and some variants also supported follow-on commands including downloading additional files, loading DLLs, updating themselves, and self-deleting, underscoring LokiBot’s continued use as a flexible credential-theft platform.
Aug 15, 2026
Researchers documented how **LokiBot** operators deploy and run their command-and-control infrastructure, showing that the malware’s PHP-based panels commonly expose a gate for receiving stolen data and an administrative interface for operators. Analysis of 1,960 real-world panel URLs found that about **95%** used the obfuscated entry point `PvqDq929BSx_A_D_M1n_a.php`, while many deployments relied on plain **HTTP** rather than HTTPS. Separate traffic analysis tooling also showed Loki-Bot exfiltrating credentials and application data over HTTP POST requests to C2 paths such as `ver.php`, reinforcing that the malware’s network activity can often be parsed and tracked in transit. A newer Loki sample also used a heavily obfuscated, multi-stage infection chain to hide delivery and execution. The attack began with an **HTA** file that concealed a PowerShell downloader through layered URL encoding, Base64, and character substitution; that downloader fetched a **VBS** script, which then retrieved an image from Google Drive containing a steganographically hidden, reversed Base64 payload. The decoded .NET assembly was injected into `aspnet_regbrowsers.exe`, after which the malware contacted C2 infrastructure and attempted to deploy additional payloads, highlighting recurring Loki tradecraft around phishing delivery, script-based loaders, steganography, and covert credential theft.
Aug 15, 2026
Recent crimeware activity shows **DarkGate**, **Emotet**, and **LokiBot** continuing to rely on layered infection chains, phishing lures, and in-memory execution to evade detection and deliver malware. DarkGate has been distributed through a multi-stage sequence involving a **VBS downloader**, **AutoIT** components, shellcode, and a final loader that decrypts and runs its payload in memory. Emotet has likewise remained active after its earlier disruption, using malicious **OneNote** attachments and **VBScript** downloaders to retrieve a DLL that decrypts shellcode and launches the final payload while attempting to avoid analysis. LokiBot activity has also persisted through phishing campaigns, including operations targeting cargo shipping companies with fake macro-themed lures and exploits for **`CVE-2017-0199`** and **`CVE-2017-11882`** to install the infostealer. U.S. government reporting has previously linked LokiBot to sustained credential theft, keylogging, password store extraction, process hollowing, HTTP-based command-and-control, and occasional backdoor functionality for follow-on payloads, underscoring that older Office vulnerabilities and social-engineering delivery remain effective for commodity malware operators.
Aug 15, 2026