HijackLoader

HijackLoader, also known as IDAT Loader and sometimes tracked as GHOSTPULSE or SHADOWLADDER, is a modular Windows malware loader used to stage and execute a wide range of follow-on payloads. It is commonly employed as an intermediary component in intrusion chains rather than as the final objective, providing operators with flexible payload delivery, in-memory execution, and evasion features. Reported downstream payloads include information stealers, remote access trojans, banking malware, ransomware precursors, and legacy backdoors such as Carbanak.

A defining characteristic of HijackLoader is its use of concealed container formats and staged decryption to reconstruct malicious components only at runtime. Multiple campaigns have used steganographic or pseudo-image data, especially PNG IDAT-style chunking, combined with XOR or similar decoding and LZNT1 decompression to rebuild large loader bundles in memory. The framework has also been observed using shellcode stages, runtime API resolution, signed host binaries, and process hollowing or related image-replacement techniques to launch final payloads while reducing static detection opportunities.

HijackLoader is frequently delivered through social-engineering-heavy initial access chains. Observed vectors include ClickFix and paste-and-run lures, fake CAPTCHA and verification pages, spearphishing attachments, trojanized software installers, and DLL sideloading packages built around legitimate signed applications. It has also appeared in broader malware distribution ecosystems involving compromised WordPress sites, fake software updates, and malvertising-driven delivery chains. In several cases, users were tricked into manually executing PowerShell commands that downloaded and launched HijackLoader stages.

The loader is associated with financially motivated cybercrime activity and is widely used across malware delivery operations rather than being exclusive to a single threat actor. It has been linked to campaigns distributing Vidar, StealC, Remcos, SnappyClient, Arechclient2, CryptBot, and other commodity or MaaS payloads. Recent reporting also noted re-emergent Carbanak activity delivered through HijackLoader, indicating its continued utility as a modern delivery mechanism for older but still operational malware families.

On infected systems, HijackLoader has demonstrated strong defense-evasion tradecraft, including binary bloating, in-memory assembly of components, abuse of signed binaries for sideloading, and deployment patterns intended to frustrate sandboxing and forensic recovery. Some observed chains also established persistence for follow-on payloads. Overall, HijackLoader is best understood as a versatile loader-as-a-service framework optimized for stealthy Windows payload delivery and post-compromise flexibility.