SmokeLoader Employs Optional Plugins to Steal Data and Launch DoS Attacks

SmokeLoader, also known as Smoke or Dofoil, has been active since 2011 as a versatile malware loader designed to deliver second‑stage payloads such as trojans, ransomware, and information stealers. Its extensible plugin framework enables modules for data exfiltration, browser credential harvesting, and distributed denial‑of‑service (DDoS) tools, among other functions, allowing operators to tailor deployments to specific goals.

After Operation Endgame in May 2024, which disrupted many SmokeLoader instances, activity waned until early 2025 when Zscaler ThreatLabz discovered a new “2025 alpha” variant, with a further variant identified by ThreatLabz by July 2025 and referred to as version 2025, noting bug fixes and a modified network protocol.

The stager bypasses analysis environments and injects the main module into explorer.exe, while the main module establishes persistence via scheduled tasks and beaconing to a C2 server to orchestrate plugin execution. Version 2025 alpha introduces several technical refinements, including mutex checks to prevent redundant injections, obfuscated constants, and a revised network protocol that now uses a 2025 version field and a CRC32 checksum, according to ThreatLabz’s analysis.

SmokeLoader remains in active use by multiple threat groups and underscores the need for robust detection and response, including behavioural monitoring for anomalous scheduled tasks and mutex‑based injections.