CoffeeLoader is a loader documented by Zscaler ThreatLabz in early 2025, built to download and run second-stage payloads while defeating endpoint and sandbox detection. Its stand-out features are a GPU-executing packer that Zscaler names Armoury — code runs on the system GPU to frustrate analysis in virtual machines that lack one — and call-stack spoofing to hide the true origin of function calls. ThreatLabz notes strong behavioural overlap with SmokeLoader and has observed CoffeeLoader being distributed by SmokeLoader.
Overview
CoffeeLoader has been active in the wild since around September 2024, with public analysis in late March 2025. No named threat actor is attributed. It is distributed by SmokeLoader and has been observed delivering Rhadamanthys stealer shellcode; its own upstream delivery vector is not fully characterised publicly. Despite the behavioural overlap, it should not be conflated with SmokeLoader.
Evasion Techniques
- Armoury GPU packer: offloads part of execution to the GPU, hindering analysis in virtualized sandboxes without a real GPU. T1497.001
- Call-stack spoofing: forges call-stack frames to mask the real caller; Zscaler notes it fabricates origin frames and uses a distinctive offset that differs from public proof-of-concept code — a useful hunting discriminator. T1027
- Sleep obfuscation that encrypts its own memory while dormant, and use of Windows fibers to obscure execution flow.
- Network resilience: a domain generation algorithm fallback when primary C2 is unreachable, and certificate pinning to resist TLS inspection. T1568.002 T1573.002
MITRE ATT&CK Mapping
Analyst-mapped; call-stack spoofing has no single clean ATT&CK identifier and is described behaviourally.
| Tactic | Technique | Usage |
|---|---|---|
| Defense Evasion | T1497.001 System Checks | GPU packer anti-VM |
| Defense Evasion | T1027 Obfuscated Files | Call-stack spoofing, sleep obfuscation |
| Execution | T1620 Reflective Code Loading | In-memory payload |
| Command and Control | T1568.002 Domain Generation Algorithms | C2 fallback |
| Command and Control | T1573.002 Asymmetric Cryptography | TLS with certificate pinning |
| Command and Control | T1105 Ingress Tool Transfer | Payload download |
Detection & Mitigation
- Deploy EDR with call-stack integrity and stack-spoofing detection; hunt for the specific forged stack offsets Zscaler documents.
- Provision analysis sandboxes with a GPU to defeat the Armoury anti-VM check; account for sleep-obfuscated, encrypted memory regions in memory scanning.
- Watch for DGA-style NXDOMAIN bursts and pinned-TLS anomalies; block SmokeLoader upstream.
Stop Loaders Before the Payload
Mjolnir Security helps organisations detect evasive loaders built to defeat the sandbox.
- Managed Detection and Response Monitoring for call-stack anomalies, unexpected GPU API use and DGA C2 patterns.
- Threat Hunting as a Service Hunting for forged call-stack offsets and SmokeLoader-to-CoffeeLoader chains.
- 24/7 Incident Response Containment before payload deployment. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts