TinyLoader Malware Spreads via Network Shares and Malicious Shortcut Files on Windows

A recently discovered TinyLoader malware campaign targets Windows users with a multi‑vector attack, including network share exploitation, USB propagation, and deceptive shortcut files, according to GBHackers On Security.

The operation serves as a delivery mechanism for other threats such as Redline Stealer and DCRat, and investigators found active TinyLoader panels and HTML signatures like “Login – TinyLoader” across its infrastructure, with command and control hosted by Virtualine Technologies in Latvia, the United Kingdom, and the Netherlands.

TinyLoader creates convincing desktop shortcuts labeled “Documents Backup.lnk” and copies itself to network shares as “Update.exe,” while it also copies itself on USB drives under names such as “Photo.jpg.exe” and “Document.pdf.exe” and uses autorun to launch on insertion. It maintains persistence by hiding copies in multiple directories and, when elevated, modifies Windows file associations to run with every opened .txt file.

The malware also monitors the clipboard to intercept cryptocurrency addresses for Bitcoin, Ethereum, Litecoin, and TRON, replacing them with attacker wallets in real time, and it downloads secondary payloads like “bot.exe” and “zx.exe” from six attacker‑controlled URLs to the system’s temporary folder. IP addresses tied to the campaign include 107.150.0[.]155 (London, GB) and 176.46.152[.]47 (Riga, LV), among others, forming a coordinated international infrastructure, according to GBHackers On Security.