HijackLoader

Aliases: DOILoader, GHOSTPULSE, IDAT Loader, SHADOWLADDER

First seen
2023-07-01 00:00:00
Malware type
loader
Family
Malware family
Last IoC activity
2026-07-22 03:55:48
Profile updated
2026-07-07 13:12:27

Targeted industries: financial-services government-and-public-sector technology-and-telecommunications

Context

According to Rapid7, this is a loader first spotted in July 2023. It implements several evasion techniques including Process Doppelgänging, DLL Search Order Hijacking, and Heaven's Gate. It has been observed to store its malicious payload in the IDAT chunk of PNG file format.

Detection coverage

  • 1 YARA rules

Detection rules

  • CAPE_Hijackloaderstub (yara-rule)

Reports & references

  • rewterz.com — Rewterz Threat Alert Widely Abused Msix App Installer Disabled By Microsoft Active Iocs (report)
  • proofpoint.com — Clipboard Compromise Powershell Self Pwn (report)
  • rapid7.com — Fake Update Utilizes New Idat Loader To Execute Stealc And Lumma Infostealers (report)
  • kroll.com — Carbanak Anunak Distributed Via Idatloader Hijackloader (report)
  • cloud.google.com — Peaklight Decoding Stealthy Memory Only Malware (report)
  • Kaspersky — 113367 (report)
  • esentire.com — Danabots Latest Move Deploying Icedid (report)
  • loginsoft.com — Blue Screen Mayhem When Crowdstrikes Glitch Became Threat Actors Playground (report)
  • kroll.com — Idatloader Distribution (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Hijackloader (report)
  • CrowdStrike — Hijackloader Expands Techniques (report)
  • alpine-sec.medium.com — Hijackloader Targets Hotels A Technical Analysis C2795Fc4F3A3 (report)
  • zscaler.com — Hijackloader Updates (report)
  • elastic.co — Tricks And Treats (report)
  • harfanglab.io — Hijackloader Abusing Genuine Certificates (report)
  • web.archive.org — Innovation In Cyber Intrusions The Evolution Of Ta544 (report)
  • elastic.co — Ghostpulse Haunts Victims Using Defense Evasion Bag O Tricks (report)
  • zscaler.com — Technical Analysis Hijackloader (report)
  • trellix.com — Analysis Of Hijackloader And Its Infection Chain (report)
  • trellix.com — How Attackers Repackaged A Threat Into Something That Looked Benign (report)
  • zscaler.com — Analyzing New Hijackloader Evasion Tactics (report)
  • zscaler.com — Technical Analysis Snappyclient (report)
  • elastic.co — A Wretch Client (report)
  • blog.gdata.de — 38376 Pivigames Verbreitet Hijackloader (report)
  • resource.redcanary.com — 2025Threatdetectionreport Redcanary (report)

External references