Cybersecurity researchers have identified a dangerous new malware loader called QuirkyLoader that has been actively distributing various malicious payloads through email spam campaigns since November 2024.
## How QuirkyLoader Works
The malware operates through a sophisticated multi-stage attack process. Cybercriminals send spam emails containing malicious archives that include three key components: a DLL file, an encrypted payload, and a legitimate executable program.
QuirkyLoader employs a technique called DLL side-loading, where launching the seemingly legitimate executable automatically loads the malicious DLL. This DLL then decrypts and injects the final malware payload into target processes using a method called process hollowing.
According to IBM X-Force researchers, the malware specifically targets three system processes: AddInProcess32.exe, InstallUtil.exe, or aspnet_wp.exe for injection.
## Malware Families Distributed
QuirkyLoader has been used to deliver several notorious malware families, including:
– Agent Tesla
– AsyncRAT
– Formbook
– Masslogger
– Remcos RAT
– Rhadamanthys Stealer
– Snake Keylogger
## Recent Attack Campaigns
Security researchers have observed targeted campaigns in July 2025 affecting Taiwan and Mexico. The Taiwan campaign specifically targeted employees of Nusoft Taiwan, a cybersecurity company, attempting to infect them with Snake Keylogger to steal browser data, keystrokes, and clipboard content.
The Mexico campaign appeared more random, distributing Remcos RAT and AsyncRAT to various targets.
## Technical Sophistication
What makes QuirkyLoader particularly concerning is its technical sophistication. The malware is written in .NET languages and uses ahead-of-time (AOT) compilation, which converts the code into native machine code. This makes the malicious binary appear as if it were written in legitimate programming languages like C or C++, helping it evade detection.
## Evolving Phishing Threats
Alongside QuirkyLoader, cybercriminals are developing new phishing techniques, including advanced QR code phishing (quishing). Attackers now split malicious QR codes into multiple parts or embed them within legitimate codes to bypass security measures.
These QR code attacks are particularly effective because they cannot be read by humans, often bypass email filters, and force victims to use mobile devices outside corporate security perimeters.
## The PoisonSeed Threat
Researchers have also discovered a sophisticated phishing kit used by the PoisonSeed threat actor. This kit targets credentials and two-factor authentication codes by impersonating login services from major companies like Google, SendGrid, and Mailchimp.
The kit uses “precision-validated phishing,” which validates email addresses in real-time while presenting fake security challenges to victims, making the attacks more convincing and successful.
## Key Takeaways
Organizations should remain vigilant against these evolving threats by implementing robust email security measures, educating employees about sophisticated phishing techniques, and maintaining updated security systems to detect advanced malware loaders like QuirkyLoader.