Loading story…
Palo Alto Networks Unit 42 reported that BunnyLoader 3.0 has expanded the capabilities of the malware-as-a-service family operated by the actor known as "Player" or "Player_Bunny", evolving from a loader and stealer into a more modular platform. The malware supports credential theft, cryptocurrency theft, clipboard hijacking, keylogging, malware delivery, and remote command execution, while the latest version adds separate stealer, clipper, keylogger, and denial-of-service modules that can be downloaded on demand through a smaller base client.
The report says the operator repeatedly retooled the malware and its infrastructure to evade detection, using packers including UPX and Themida, delivery through PureCrypter, and lures masquerading as legitimate software and games. BunnyLoader 3.0 also changed its command-and-control design to use a single gate.php endpoint, RC4-obfuscated HTTP parameters, and operator-defined URL paths, while continuing to target browser data, crypto wallets, messaging apps, VPNs, gaming platforms, files, and selected financial or authentication windows; Unit 42 published associated indicators of compromise, hashes, C2 details, and a YARA rule for detection.
Pull IOCs and campaign context straight into your stack.
12 events from the most recent confirmed update back to the earliest known activity.
The first known BunnyLoader 3.0 sample was identified on Feb. 14, 2024 by security researcher Germán Fernández from a malicious .cmd script discovered by @ViriBack. The sample used a dropper delivered via a malicious CMD file with the BunnyLoader payload embedded inside.
On Feb. 11, 2024, the threat actor announced BunnyLoader 3.0 on Telegram and claimed it had been completely redesigned and enhanced by 90%. The announcement said the payloads and modules were rewritten, the payload size was reduced, and keylogging was improved.
Threat actors used BunnyLoader in December 2023 to deliver the Meduza stealer. This demonstrated the loader's role in distributing other malware families.
In December 2023, one BunnyLoader-related infection branch dropped the PureLogs loader and then delivered the PureLogs stealer. This showed BunnyLoader-associated delivery activity branching into additional malware deployment.
In December 2023, BunnyLoader was delivered as a follow-on payload to a PureCrypter infection using a novel .NET injector. One infection branch masqueraded the malware as notepet.exe or notep.exe.
Unit 42 observed BunnyLoader command-and-control servers at 134.122.197[.]80 and 91.92.254[.]31 in December 2023. The sightings showed the operator continuing to rotate infrastructure.
Unit 42 observed BunnyLoader campaigns in November 2023 using command-and-control servers at 195.10.205[.]23 and 172.105.124[.]34. This reflected continued infrastructure changes by the operator.
In October 2023, BunnyLoader samples were delivered through a ZIP archive named Shovel Knight.zip. The archive contained a Windows executable stager for BunnyLoader 2.0.
In October 2023, the author offered a private version of BunnyLoader for $350. The operator said this version was obfuscated and regularly updated to evade antivirus detection.
Unit 42 observed BunnyLoader command-and-control infrastructure at 185.241.208[.]83 in October 2023. The malware's early infrastructure used a standardized /Bunny/ PHP endpoint structure for communications.
The BunnyLoader author, tracked as “Player” or “Player_Bunny,” initially offered BunnyLoader 1.0 on Sept. 4, 2023 for $250 lifetime access. The malware was promoted as a botnet and loader written in C/C++ with credential, cryptocurrency, and clipboard theft capabilities.
By the end of September 2023, the author had added bug fixes, antivirus evasion, more data recovery methods, extra browser paths, keylogging, and anti-analysis protections. The author released BunnyLoader 2.0 by the end of that month, and it was observed in the wild.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked **PrivateLoader** to a long-running pay-per-install malware ecosystem that used SEO-poisoned sites and cracked-software lures to infect Windows users with password-protected ZIP archives and NSIS installers. The loader was repeatedly observed delivering a wide range of payloads, including **RedLine**, **Vidar**, **SmokeLoader**, **RisePro**, **Qbot**, **Dridex**, **DanaBot**, **TrickBot**, **Kronos**, **LockBit**, **STOP Djvu**, and **Conti**, while related tooling such as **Discoloader** and the Go-based **Anubis Loader** expanded the same distribution chain. Investigations described administration panels used to manage payload links, browser extensions, bot installs, and operator activity, with one panel reportedly overseeing about **20,000 bots** and collecting more than **11 GB** of stealer logs in less than two weeks. Separate reporting showed PrivateLoader also acting as an access broker for other criminal and state-linked operations. Analysts observed it distributing **ColibriLoader** in a campaign tied to **UAC-0113**, a group CERT-UA has associated with **Sandworm**, and later delivering **Socks5Systemz**, a proxy botnet that converted infected Windows hosts into rentable proxies. Bitsight estimated Socks5Systemz had about **10,000 infected systems** and at least **53 servers** supporting command-and-control, telemetry, DNS, and backconnect functions, with customers buying proxy access through a Telegram-linked service for cryptocurrency. Across the reporting, PrivateLoader emerged as a versatile initial-access platform connecting commodity stealers, banking trojans, ransomware, proxy monetization, and higher-end intrusion activity.
Aug 15, 2026
Researchers reported multiple financially motivated malware campaigns using **SmokeLoader** as a delivery mechanism for follow-on payloads including **Gozi ISFB**, **ZLoader**, **Oski**, **AveMaria**, **Cobalt Strike**, **SystemBC**, **RecordBreaker**, and the **Laplas Clipper** cryptocurrency hijacker. In one campaign set, attackers abused website contact forms and sent phishing lures posing as copyright complaints, directing victims to malicious documents hosted on legitimate services such as **Google Drive**. Talos found the initial payloads were wrapped in a shared crypter identified by the DOS-stub string **"Salfram,"** indicating a common tooling layer across otherwise varied malware deliveries. The activity relied on evasive and modular infection chains designed to complicate detection and maximize monetization. The **Salfram** crypter used obfuscation methods including fake API calls, fragmented control flow, self-modifying code, and memory allocation through `ZwAllocateVirtualMemory`, while later-stage malware added persistence and theft capabilities. Cyble said **Laplas Clipper** monitored the clipboard for cryptocurrency wallet addresses, pulled regex patterns and replacement addresses from `clipper[.]guru`, and persisted by copying itself into `%appdata%` and creating a scheduled task that ran every minute. The combined use of phishing, legitimate hosting platforms, crypter-based obfuscation, and multi-payload delivery shows an adaptable criminal ecosystem built to steal credentials, proxy access, banking data, and cryptocurrency funds.
Aug 15, 2026
Researchers reported that **Amadey** has evolved from an information-stealing bot into a broader malware delivery platform, with newer variants adding screenshot capture, expanded credential theft, clipboard hijacking, and delivery of follow-on payloads such as **Remcos RAT**, **RedLine Stealer**, and **LockBit 3.0**. Recent analyses said the malware is being distributed through multiple channels including the **RIG Exploit Kit**, phishing emails, fake software installers, torrent-distributed cracks and keygens, malicious Office documents, and gaming cheat sites. Once executed, Amadey typically profiles the host, checks for security products, establishes persistence through registry changes, scheduled tasks, or startup-folder abuse, and communicates with command-and-control servers over plain HTTP to fetch plugins and additional malware. Multiple reports said Amadey operators are using modular DLL components such as `cred.dll`, `scr.dll`, `clip64.dll`, and newer credential-stealing plugins to harvest browser, remote access, FTP, Outlook, and MikroTik data while also capturing screenshots and replacing cryptocurrency wallet addresses in the clipboard. Long-term infrastructure tracking found hundreds of active Amadey C2 servers and thousands of secondary payloads, showing that the malware has become a durable **loader-as-a-service** platform with ties to overlapping criminal campaigns. Analysts also observed delivery chains involving SmokeLoader and Nitol, abuse of public-interest lures such as fake KakaoTalk updates, and continued use of Amadey to stage ransomware and remote-access infections on compromised Windows systems.
Aug 15, 2026