Lokibot

LokiBot is a long-running commodity information stealer first advertised in 2015 and later proliferated through multiple forks after its source code leaked in 2018. It is primarily known for credential theft from a broad set of Windows applications, including web browsers, email clients, FTP and SFTP software, Windows credential sources, and in some variants cryptocurrency-related applications. Some reporting also attributes keylogging and expanded remote-access-style functionality to later forks, but its core role remains credential harvesting and data exfiltration.

LokiBot is commonly delivered through phishing and malspam campaigns, often using malicious attachments such as JScript, spreadsheet, or other document-based lures that rely on user execution or enabling active content. Observed campaigns have used multi-stage loaders involving obfuscated script stages, PowerShell, in-memory .NET components, and process injection into legitimate Windows processes to launch the final payload while reducing detection. LokiBot has also appeared as a payload delivered by other malware distribution services and loaders, including steganography-enabled campaigns and shellcode-based downloaders.

On infected Windows systems, LokiBot has demonstrated runtime API resolution, mutex-based single-instance control, copying itself into hidden files or directories, registry modification associated with UAC bypass or Run-key persistence attempts, and outbound communication with command-and-control infrastructure to transmit stolen data. Collected information is compressed before exfiltration in some variants. LokiBot also performs host profiling such as username discovery and has been observed using PowerShell during execution chains. Updated variants have used steganographic techniques to conceal code within image files.

LokiBot has remained prevalent for years because of its low cost, accessibility to lower-skill operators, and effectiveness in account theft operations. It has been associated with broad cybercrime activity rather than a single exclusive operator, including use in phishing-heavy ecosystems such as those linked to SilverTerrier and TA558. It continues to target organizations and individuals opportunistically across sectors wherever stolen credentials can be monetized.