Loading malware…
Hijack Loader, also known as DOILoader and IDAT Loader, is a Windows malware loader used to stage and execute additional payloads for downstream intrusion activity. It is commonly employed as an intermediary component in multi-stage infection chains, where its primary role is to launch or enable follow-on malware such as information stealers and remote access trojans. Reported downstream payloads include families such as Lumma Stealer, Vidar Stealer, RedLine Stealer, Rhadamanthys, Remcos RAT, and other commodity malware.
The loader has been observed across a wide range of criminal delivery ecosystems, including ClickFix-style social engineering, compromised websites, malvertising, SEO poisoning, fake software installers, cracked software lures, and spearphishing campaigns. It has appeared in campaigns abusing interest in AI tools, fake browser or security prompts, trojanized software downloads, and messaging-platform-delivered archives containing malicious shortcut files. In some operations it is delivered by another loader, such as RenEngine Loader, Emmenhtal-related chains, or CastleLoader, underscoring its role as a flexible second-stage execution component.
Hijack Loader is associated with defense evasion and stealth-oriented execution. Observed campaigns involving it have used techniques including DLL side-loading, module stomping, in-memory reconstruction, process injection, scheduled-task persistence, and environmental checks for security products. It has also been linked to staged execution flows that reduce forensic visibility through cleanup and anti-analysis behavior. In at least some campaigns, surrounding scripts or loaders performed reconnaissance, altered Microsoft Defender settings, and removed artifacts after execution.
The malware has been used by multiple cybercriminal actors and delivery clusters rather than a single exclusive operator. It has been referenced in activity tied to ClearFake, Storm-3075-related malvertising, GrayBravo/CastleLoader ecosystems, and Russia-aligned UAC-0184 operations targeting Ukrainian government and military entities. It was also named among malware families targeted by Operation Endgame in 2025, reflecting its significance in the broader loader ecosystem.
Hijack Loader primarily targets Windows systems and serves as an enabling platform for credential theft, remote access, and broader post-compromise activity by the payloads it deploys. Its prevalence across commodity crimeware campaigns and targeted intrusion chains makes it a notable execution and delivery layer in the contemporary malware landscape.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
While the example campaign described in this section delivered Vidar Stealer, we have also observed this campaign distributing Lumma Stealer, Hijack Loader, and Oyster.
Credential Theft and Remote Access Surge as AllaKore, PureRAT, and Hijack Loader Proliferate
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Since at least early 2026, Microsoft Threat Intelligence has observed malvertising campaigns that use AI-themed terms such as “Awesome AI Windows Plugin” and “Flux Pro AI” in social engineering lures ... Microsoft attributes this malvertising activity to an initial access broker and malware distributor tracked as Storm-3075.
The malware collects the victim’s external IP address and username, checks for an existing scheduled task named MSSecurity...
"distributed via a heavily obfuscated Inno Setup installer"; "Delivered via a downloader in a ZIP archive"; "illegally modified game installers distributed via piracy platforms"
The archives contained a heavyweight Win32 PE that masqueraded as the DeepSeek installer.
Before exiting, the malware removes: All downloaded ZIPs and folders The exfiltrated result file Itself via a helper script deleter.ps1
The malware collects the victim’s external IP address... $externalIP = Invoke-RestMethod -Uri "http://ifconfig.me/ip"
The malware collects the victim’s external IP address and username... $username = $env:USERNAME
The script attempts to evade detection by creating Windows Defender exclusions for the entire C drive and two known processes often abused in malware campaigns. Add-MpPreference -ExclusionPath $folderPath Add-MpPreference -ExclusionProcess $processName Add-MpPreference -ExclusionProcess $processName1
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader malware observed as one of the payloads distributed through AI-themed malvertising campaigns.
Loader malware observed as one of the payloads distributed through AI-themed malvertising campaigns.
Multi-stage loader delivered via a repo-squatting / Google Ads campaign (GPUGate) using a trojanized installer.
Secondary-stage loader used in RenEngine Loader campaigns to ultimately deploy Lumma Stealer.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.