Cybersecurity researchers have identified an updated version of Hijack Loader malware featuring new capabilities designed to evade detection and maintain persistence on infected systems. According to Zscaler ThreatLabz, the loader now implements call stack spoofing to hide function call origins and includes anti-VM checks to detect analysis environments.
First discovered in 2023, Hijack Loader (also known as DOILoader, GHOSTPULSE, IDAT Loader, and SHADOWLADDER) specializes in delivering second-stage payloads like information stealers while bypassing security software. Recent campaigns have utilized legitimate code-signing certificates and the ClickFix distribution strategy.
The latest version introduces several improvements:
– Call stack spoofing that replaces actual stack frames with fabricated ones
– Continued use of the Heaven’s Gate technique for 64-bit direct syscalls
– An expanded blocklist including Avast Antivirus components
– New ANTIVM module for virtual machine detection
– A modTask module for persistence via scheduled tasks
## SHELBY Malware Leverages GitHub for Command-and-Control
Elastic Security Labs has uncovered a new malware family called SHELBY that innovatively uses GitHub for command-and-control operations, data exfiltration, and remote control. The attack chain begins with targeted phishing emails containing a ZIP archive that executes a DLL loader (SHELBYLOADER) through side-loading.
The loader communicates with GitHub to extract a 48-byte value from a “License.txt” file in the attacker’s repository. This value generates an AES decryption key to decrypt and load the main backdoor payload without leaving disk artifacts.
The SHELBYC2 backdoor parses commands from a “Command.txt” file to:
– Download/upload files from/to GitHub
– Load .NET binaries reflectively
– Execute PowerShell commands
Communication occurs through commits to private repositories using embedded Personal Access Tokens, creating a security risk as anyone with the token can potentially access commands and outputs.
## Emmenthal Loader Distributing SmokeLoader
Researchers have also identified payment-themed phishing campaigns delivering Emmenthal Loader (PEAKLIGHT), which subsequently deploys SmokeLoader malware. This particular SmokeLoader variant uses .NET Reactor for obfuscation and packing, representing a shift from its historical use of packers like Themida and Enigma Protector.