HijackLoader

Proofpoint and IBM X-Force collaborated with Europol and Microsoft's Digital Crimes Unit to disrupt the StealC malware-as-a-service ecosystem as part of Operation Endgame, seizing 66 domains, 296 servers, and over 25.6 million stolen credentials. Researchers discovered a directory traversal vulnerability in the StealC PHP C2 panel's filename handling during ZIP extraction, which was exploited by law enforcement to access and seize C2 servers. The teams also built a StealC bot emulator to track affiliate infrastructure and observe payload delivery chains, revealing StealC's loader functionality distributing a broad range of secondary malware including ransomware, RATs, and additional stealers.

2026-06-167 minSekoia.iohigh

ErrTraffic is a Malware-as-a-Service framework that compromises WordPress sites and uses malvertising to deliver ClickFix social engineering lures. It leverages EtherHiding via Polygon smart contracts to dynamically resolve C2 infrastructure and distribute infostealers, RATs, and loaders.

2026-05-135 minZscaler ThreatLabzhigh

SnappyClient is a newly discovered C++ C2 framework implant delivered via HijackLoader, primarily designed for cryptocurrency theft and remote access. It utilizes advanced evasion techniques such as AMSI patching, Heaven's Gate, and transacted hollowing to bypass security controls, including Chromium's App-Bound Encryption, while communicating over a custom ChaCha20-Poly1305 encrypted protocol.