HijackLoader is a modular Windows loader that emerged in 2023 and rose quickly to become a top-tier delivery mechanism for commodity stealers and RATs. It is known for DLL-sideloading execution, concealing its payload inside PNG image files — originally in the PNG IDAT chunk, later in pixel data — and a steadily expanding set of evasion modules. In 2024 it became a favoured loader for the Lumma stealer and spread heavily via ClickFix paste-and-run social engineering. It is also tracked as IDAT Loader and GHOSTPULSE.
Overview
HijackLoader is a commodity loader used by many unrelated groups. It delivers a wide range of payloads — Lumma (dominant in 2024), AsyncRAT, Remcos, StealC, Vidar, DanaBot and SectopRAT — and Kroll reported a sample delivering a recent Carbanak build, indicating more advanced-actor use.
How It Works
- PNG payload concealment: early builds stored the encrypted payload in the PNG IDAT chunk; newer builds embed it in pixel data, reading RGB values to rebuild and XOR-decrypt a byte array. T1027.003 T1140
- DLL sideloading: ships as a ZIP bundling a legitimate, often signed executable vulnerable to sideloading plus a malicious DLL. T1574.002
- Injection and evasion: process injection and hollowing, direct syscalls to bypass user-mode hooks, and 2025 modules adding call-stack spoofing and anti-VM checks. T1055.012 T1106 T1497
- Persistence via scheduled tasks and a Startup-folder shortcut referencing a BITS job. T1053.005 T1197
Delivery
HijackLoader spread heavily in 2024 through ClickFix fake-CAPTCHA pages that instruct the victim to run an encoded PowerShell command, dropping a ZIP and triggering the sideloading chain; late-2024 campaigns used legitimately code-signed components to add trust. It also arrives via malvertising, trojanized software and phishing. T1204.004 T1059.001
MITRE ATT&CK Mapping
An official ATT&CK Software entry could not be confirmed; the techniques below are analyst-mapped from vendor reporting.
| Tactic | Technique | Usage |
|---|---|---|
| Defense Evasion | T1574.002 DLL Side-Loading | Core execution |
| Defense Evasion | T1027.003 Steganography | Payload hidden in PNG |
| Defense Evasion | T1055.012 Process Hollowing | Injection into processes |
| Execution | T1204.004 Malicious Copy and Paste | ClickFix delivery |
| Persistence | T1053.005 Scheduled Task | Persistence |
| Defense Evasion | T1197 BITS Jobs | Startup LNK to BITS job |
Detection & Mitigation
- Detect DLL sideloading: an unsigned DLL beside a signed executable in an abnormal, user-writable path; apply application control (WDAC).
- Flag a process reading a PNG and decoding then executing it in memory with no image rendering.
- Block the ClickFix pattern — clipboard-sourced PowerShell after a “verify” page — with user training and interpreter restrictions; alert on scheduled-task and Startup LNK plus BITS persistence. Elastic’s published GHOSTPULSE YARA aids detection.
Stop Loaders Before the Payload
Mjolnir Security helps organisations detect modular loaders and the stealers they deliver.
- Managed Detection and Response Monitoring for DLL sideloading, PNG-decode-then-execute and ClickFix delivery chains.
- Threat Hunting as a Service Hunting for HijackLoader footholds and follow-on stealer payloads.
- 24/7 Incident Response Containment before payload deployment. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts