Loading malware…
GHOSTPULSE, also known as HijackLoader and IDATLoader, is a multi-stage Windows malware loader active since 2023. It is designed to decrypt, stage, and inject final payloads while evading endpoint detection. Observed payloads include SectopRAT/ArechClient2, Lumma Stealer, Rhadamanthys, Vidar, RedLine, and NetSupport RAT. The loader has been distributed in malicious signed MSIX packages impersonating legitimate software, as well as MSI, executable, ISO, and DLL-sideloading infection chains. Campaigns have used SEO poisoning, malvertising, compromised websites, and ClickFix fake-CAPTCHA lures that induce victims to execute clipboard-delivered PowerShell commands. GHOSTPULSE commonly abuses DLL sideloading, module stomping, direct NT API invocation, cross-process injection, and Process Doppelgänging. It can establish shortcut-based persistence and uses encrypted configuration and payload data concealed in image-related structures, evolving from PNG IDAT chunks to pixel data and headerless IDAT-style containers. Some activity is consistent with FakeBat-linked MSIX operations, but a distinct operator attribution for GHOSTPULSE is not established.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
The malware then initiates a suspended child process using the executable specified in the Stage 2 configuration, which is a 32-bit cmd.exe in this case.
The user is instructed to copy a seemingly harmless 'fix' (which is a malicious PowerShell command) and paste it directly into their operating system's run dialog.
Stage 2 reads ntdll.dll from disk, obtains NT API offsets, and directly invokes the APIs to evade userland hooks set by security products.
“In 2025, Elastic Security Labs documented a campaign in which a threat actor used the Ghostpulse malware loader to deliver SectopRAT following a ClickFix social-engineering attack.”
“GHOSTPULSE ... decrypts and injects its final payload to evade detection.”
The primary thread’s execution is then redirected to the malicious code in mshtml.dll with the Wow64SetThreadContext API.
Shellcode contained inside the decrypted blob is written to the .text section of freshly loaded mshtml.dll and then executed; this is known as module stomping.
GHOSTPULSE employs Process Doppelgänging, leveraging NTFS transactions to inject the final payload into a new child process.
“The extractor takes as input the encrypted file shipped with GHOSTPULSE which contains it's different stages and the final payload.”
“Instead of extracting the payload from the IDAT chunk, the latest version of GHOSTPULSE now parses the pixels of the image to retrieve its configuration and payload.”
This is done to evade userland hooks set by security products.
Stage 1 and Stage 2 build Import Address Tables, using custom API-name hashing algorithms; Stage 2 uses CRC32.
“Now, the entire package consists of a single file—a benign but compromised executable that includes the PNG file within its resources section.”
The encrypted data is stored in chunks in handoff.wav, while the final payload and configuration are encrypted and XOR-decrypted at runtime.
Observed masquerading themes include installers for Chrome, Brave, Edge, Grammarly, and WebEx. VBoxSVC.exe is actually a renamed signed gup.exe executable.
“GHOSTPULSE ... decrypts and injects its final payload to evade detection.”
The primary thread’s execution is then redirected to the malicious code in mshtml.dll with the Wow64SetThreadContext API.
Shellcode contained inside the decrypted blob is written to the .text section of freshly loaded mshtml.dll and then executed; this is known as module stomping.
GHOSTPULSE employs Process Doppelgänging, leveraging NTFS transactions to inject the final payload into a new child process.
55 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware loader used in a 2025 ClickFix social-engineering campaign to deliver SectopRAT.
Loader delivered through a trojanized Qt5Network.dll via DLL sideloading. It activates in DllMain, reads encrypted payload and config files, parses IDAT chunk data from a fake XML container, extracts the XOR key from the config, decrypts the payload, and injects DeerStealer into memory. The sample uses headerless PNG IDAT chunk framing rather than a valid PNG image.
Payload concealment and delivery technique/tool using PNG IDAT chunk structure to hide custom-encrypted shellcode. In this chain it is used to store and deliver the encrypted payload processed by HijackLoader.
With the release of v0.16, here are the different malware families that we cover. blister deprecated ghostpulse latrodectus lobshot lumma netwire redlinestealer remcos smokeloader stealc strelastealer xorddos
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.