HijackLoader: The Stealthy Malware Loader Powering Modern Cyberattacks

HijackLoader has emerged as a stealthy malware loader used to gain initial access, evade defenses and deliver sophisticated payloads, with Seqrite highlighting its prominence since mid-2023 and its growing role in Malware-as-a-Service offerings. Since mid‑2025, it has been observed in Clickfix phishing campaigns, where users are tricked into downloading malicious .msi installers that, in turn, execute HijackLoader, according to Seqrite.

The MaaS ecosystem has integrated HijackLoader as a delivery mechanism, with the threat group TAG-150 seen leveraging it alongside CastleLoader/CastleBot. Seqrite notes a focus on stealth and persistence, including process doppelgänging with transacted sections, unhooking system DLLs, direct syscalls under WOW64, call-stack spoofing and anti-VM checks, which help it evade sandboxes and detection tools.

The infection chain begins with a CAPTCHA-based phishing lure, leading to obfuscated PowerShell scripts and staged payloads, with final payloads connecting to a C2 server linked to NekoStealer and Lumma Stealer. According to Seqrite, defending against such loaders requires shifting focus from static final-stage payloads to their dynamic and evolving delivery mechanisms, and organisations should monitor intermediate attack stages as well.