Loading story…
Researchers documented how LokiBot operators deploy and run their command-and-control infrastructure, showing that the malware’s PHP-based panels commonly expose a gate for receiving stolen data and an administrative interface for operators. Analysis of 1,960 real-world panel URLs found that about 95% used the obfuscated entry point PvqDq929BSx_A_D_M1n_a.php, while many deployments relied on plain HTTP rather than HTTPS. Separate traffic analysis tooling also showed Loki-Bot exfiltrating credentials and application data over HTTP POST requests to C2 paths such as ver.php, reinforcing that the malware’s network activity can often be parsed and tracked in transit.
A newer Loki sample also used a heavily obfuscated, multi-stage infection chain to hide delivery and execution. The attack began with an HTA file that concealed a PowerShell downloader through layered URL encoding, Base64, and character substitution; that downloader fetched a VBS script, which then retrieved an image from Google Drive containing a steganographically hidden, reversed Base64 payload. The decoded .NET assembly was injected into aspnet_regbrowsers.exe, after which the malware contacted C2 infrastructure and attempted to deploy additional payloads, highlighting recurring Loki tradecraft around phishing delivery, script-based loaders, steganography, and covert credential theft.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
An example PCAP shows Loki-Bot version 1.8 exfiltrating application and credential data from a Windows 8.1 workstation to 185.141.27.187 over HTTP POST to /danielsden/ver.php. The transmission is timestamped as the first observed send in the sample traffic.
LokiBot was first advertised in underground forums in 2015 as an information stealer and keylogger, marking its emergence as a malware offering.
A Loki information-stealing malware sample analyzed by Logpoint was discovered on MalwareBazaar among recent malware uploads, providing the basis for analysis of its infection chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
logpoint.com
Open sourcevirusbulletin.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple security reports documented **LokiBot/Loki Info Stealer** campaigns delivered through phishing emails that used a wide range of attachment types and exploit chains, including **LZH**, **ACE**, **RAR**, **PDF**, **DOCX**, **RTF**, and Excel-based lures. The messages commonly impersonated business documents such as payment confirmations, invoices, shipment notices, and purchase orders, while some samples abused PDF `OpenAction`, embedded URI actions, malicious macros, or exploits including **`CVE-2016-0189`**, **`CVE-2017-11882`**, **`CVE-2021-40444`**, and **`CVE-2022-30190`** to download or launch the malware. Researchers also observed compromised infrastructure hosting downloaders and payloads, along with HTTP POST traffic to attacker-controlled command-and-control endpoints. Once executed, LokiBot used layered evasion and execution techniques such as **process hollowing**, shellcode loaders, API hashing, anti-debugging, anti-VM checks, obfuscation, and in-memory decryption to avoid detection. The malware established persistence in user profile and startup locations, hid files under `%APPDATA%`, and stole credentials and data from browsers, FTP clients, email applications, password managers, Windows credentials, Microsoft Outlook registry entries, and even user files such as Stickies notes. Stolen information was compressed and exfiltrated over HTTP, and some variants also supported follow-on commands including downloading additional files, loading DLLs, updating themselves, and self-deleting, underscoring LokiBot’s continued use as a flexible credential-theft platform.
Aug 15, 2026
A recent phishing campaign is delivering **LokiBot** through malicious email attachments containing obfuscated JScript, reviving the long-running infostealer with a multi-stage infection chain designed to evade detection. The script runs via Windows Script Host, decodes a PowerShell loader, and decrypts a ConfuserEx-protected .NET injector that reflectively loads into memory before injecting the final payload into `aspnet_compiler.exe` using Windows APIs including `CreateProcessA`, `VirtualAllocEx`, `WriteProcessMemory`, `SetThreadContext`, and `ResumeThread`. Once executed, the 32-bit LokiBot payload uses API hashing and runtime API resolution, creates a mutex derived from the victim system's `MachineGuid`, steals credentials from numerous applications, compresses the data with **aPLib**, and beacons to HTTP command-and-control servers roughly every minute. Researchers said the malware stores C2 addresses with **3DES** encryption and noted a flawed persistence mechanism in some newer builder-generated samples, where a patched decryption routine causes the malware to use a C2 URL instead of the intended Run registry path; reported infrastructure includes the IP address `158.94.211.95`, and defenders were urged to block script-based attachments and watch for abnormal `aspnet_compiler.exe` activity.
Jun 29, 2026
Recent crimeware activity shows **DarkGate**, **Emotet**, and **LokiBot** continuing to rely on layered infection chains, phishing lures, and in-memory execution to evade detection and deliver malware. DarkGate has been distributed through a multi-stage sequence involving a **VBS downloader**, **AutoIT** components, shellcode, and a final loader that decrypts and runs its payload in memory. Emotet has likewise remained active after its earlier disruption, using malicious **OneNote** attachments and **VBScript** downloaders to retrieve a DLL that decrypts shellcode and launches the final payload while attempting to avoid analysis. LokiBot activity has also persisted through phishing campaigns, including operations targeting cargo shipping companies with fake macro-themed lures and exploits for **`CVE-2017-0199`** and **`CVE-2017-11882`** to install the infostealer. U.S. government reporting has previously linked LokiBot to sustained credential theft, keylogging, password store extraction, process hollowing, HTTP-based command-and-control, and occasional backdoor functionality for follow-on payloads, underscoring that older Office vulnerabilities and social-engineering delivery remain effective for commodity malware operators.
Aug 15, 2026