Hijack Loader
Hijack Loader is a modular Windows malware loader used as a conduit for additional payloads, including information stealers and remote access trojans. The content explicitly identifies it as also known as DOILoader and IDAT Loader. It is described as a stage-1 downloader or payload enabler and has been observed reconstructing payloads in memory, decrypting embedded data, injecting shellcode into newly spawned processes, and deploying follow-on malware via process injection, including Remcos RAT into the legitimate Chime.exe process.
Observed delivery vectors include malicious PowerShell downloaders, ClickFix-style social engineering, compromised websites, SEO poisoning, malvertising, fake software installers, pirated or cracked software lures, MSI installers, ZIP archives containing LNK files, and abuse of platforms such as YouTube and Viber. In one documented chain, a PowerShell script from fancysunshine[.]top downloaded RD.zip, extracted it under %TEMP% into fake Chrome cache folders, and executed S-D.exe; the payload in RD.zip was identified as Hijack Loader. That script also added Windows Defender exclusions for C:\ and for MicrosoftEdgeUpdate.exe and SecurityHealthSystray.exe, collected the victim external IP and username, checked for a scheduled task named MSSecurity, exfiltrated result.txt to upload.php on fancysunshine[.]top, and cleaned up downloaded artifacts.
The malware appears across multiple criminal delivery ecosystems and campaigns. ClearFake campaigns delivered Hijack Loader to Windows systems alongside Amadey and IDAT Loader. Microsoft reported Storm-3075-related AI-themed malvertising and other campaigns distributing Hijack Loader alongside Lumma Stealer and Oyster. SEO poisoning campaigns used fake Cloudflare CAPTCHA pages and ClickFix to drop RedLine Stealer via Hijack Loader. Other observed chains used Hijack Loader to deploy Lumma Stealer, Atomic Stealer, Vidar Stealer, Rhadamanthys, RedLine Stealer, ACR Stealer, and Remcos RAT. RenEngine Loader has been reported decrypting, staging, and transferring execution to Hijack Loader to enable flexible downstream payload deployment.
Associated threat activity in the content includes Russia-aligned UAC-0184 / Hive0156 targeting Ukrainian military and government entities via Viber-delivered ZIP archives with malicious LNK files. In that campaign, PowerShell, DLL side-loading, module stomping, in-memory payload reconstruction, scheduled-task persistence, and security-product checks were used before Hijack Loader launched Remcos RAT. GrayBravo activity also includes distribution of Hijack Loader through the CastleLoader ecosystem. The malware was also specifically named as a target of the May 2025 Operation Endgame action.
High-confidence indicators and artifacts mentioned in the content include fancysunshine[.]top, Add.ps1, RD.zip, S-D.exe, %TEMP%/chrome_BITS_5484_11223155, %TEMP%/chrome_BITS_5484_11123155, upload.php, result.txt, deleter.ps1, smoothieks.zip, and abuse of legitimate executables such as CFlux.exe and Chime.exe in side-loading and injection chains.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
While the example campaign described in this section delivered Vidar Stealer, we have also observed this campaign distributing Lumma Stealer, Hijack Loader, and Oyster.
Credential Theft and Remote Access Surge as AllaKore, PureRAT, and Hijack Loader Proliferate
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
2 techniques
Resource Development
Since at least early 2026, Microsoft Threat Intelligence has observed malvertising campaigns that use AI-themed terms such as “Awesome AI Windows Plugin” and “Flux Pro AI” in social engineering lures ... Microsoft attributes this malvertising activity to an initial access broker and malware distributor tracked as Storm-3075.
Initial Access
1 technique
Initial Access
Execution
3 techniques
Execution
The malware collects the victim’s external IP address and username, checks for an existing scheduled task named MSSecurity...
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
5 techniques
Stealth
"distributed via a heavily obfuscated Inno Setup installer"; "Delivered via a downloader in a ZIP archive"; "illegally modified game installers distributed via piracy platforms"
The archives contained a heavyweight Win32 PE that masqueraded as the DeepSeek installer.
Before exiting, the malware removes: All downloaded ZIPs and folders The exfiltrated result file Itself via a helper script deleter.ps1
Credential Access
1 technique
Credential Access
Discovery
4 techniques
Discovery
The malware collects the victim’s external IP address... $externalIP = Invoke-RestMethod -Uri "http://ifconfig.me/ip"
The malware collects the victim’s external IP address and username... $username = $env:USERNAME
Collection
1 technique
Collection
Command and Control
1 technique
Command and Control
Exfiltration
1 technique
Exfiltration
Other
1 technique
Other
The script attempts to evade detection by creating Windows Defender exclusions for the entire C drive and two known processes often abused in malware campaigns. Add-MpPreference -ExclusionPath $folderPath Add-MpPreference -ExclusionProcess $processName Add-MpPreference -ExclusionProcess $processName1
IOCs tracked for this family
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader malware observed as one of the payloads distributed through AI-themed malvertising campaigns.
Loader malware observed as one of the payloads distributed through AI-themed malvertising campaigns.
Multi-stage loader delivered via a repo-squatting / Google Ads campaign (GPUGate) using a trojanized installer.
Secondary-stage loader used in RenEngine Loader campaigns to ultimately deploy Lumma Stealer.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.