Topic
Multi-stage loaders that sit between initial access and final payload, reused across otherwise unrelated campaigns.
Varonis Threat Labs found AvisLoader, a Windows loader whose C2 runs over the Tox P2P network with no fixed domain. Varonis says that makes domain takedowns harder, though the Tox connections stay observable next to the loader's activity on the host.
Reality
Sophos linked ClickFix lures that open Windows Terminal, not the Run dialog, to STAC4924, a campaign it has tracked since at least March. The intrusions plant Lorem Ipsum Loader and a Python reverse-tunnel implant that relays attacker traffic through the victim host.
Reality
Zscaler ThreatLabz says 2CLoader, found in August 2026, drops the Vidar and Remus stealers and XWorm RAT while routing six ntdll calls around EDR's inline hooks. Detection tuned only to those payloads misses the loader stage.
Reality
Expel's teardown of a loader first compiled around 28 July 2026 puts the whole delivery chain outside email, and says its module hashes change with every infection.
Reality
AvisLoader statically links the reference Tox client, so its operator keeps the same identity after moving to a new server. The ClickFix page and Cloudflare tunnel that deliver it are still ordinary takedown targets.
Reality
Palo Alto Networks Unit 42 says the pay-per-install marketplace fed gamers and professionals into the same loader, OfferLoader, and its trojanized installers reached corporate endpoints at critical infrastructure and government entities.
Reality
The Justice Department sentenced Oleksii Lytvynenko to four years over Conti, the ransomware the FBI ties to more than $150m in victim payouts as of January 2022 and to attacks in 47 states. Four others stand charged in the same district.
Reality
Unit 42's CL-CRI-1171 sold installs to other criminals for at least two years, funneling gamers through YouTube and professionals through poisoned search results, while its loader stayed unnamed because nobody escalated it.
Reality
Malwarebytes traces one loader through ClickFix prompts, malicious game installs and fake software downloads. The shared part is a .csproj-to-MSBuild handoff and a blockchain lookup for C2.
Reality