New Olymp Loader Malware-as-a-Service Promises Defender Bypass with Auto Certificate Signing

Olymp Loader, a newly emerged Malware-as-a-Service (MaaS) offering, has rapidly gained traction across underground forums and Telegram since its debut on 5 June 2025. Developed by a trio of seasoned Assembly coders under the alias “OLYMPO,” the loader features fully Assembly-based modules, advanced evasion techniques, and built-in stealer functionality aimed at low- and mid-tier cybercriminals seeking turnkey attack tools.

Originally marketed as “Olymp Botnet,” the project quickly pivoted into a loader service and, more recently, into a crypter-centric solution, with a dynamic roadmap to bundle a stager generator, loader, botnet, file scanner, and crypter into a unified Orophware suite.

As of 5 August 2025, pricing includes Classic Stub at US$50 with defender-bypass, defender-remover, and automatic certificate signing; Personal Shellcode Modifications at US$100; and Unique Stub at US$200, with capabilities spanning 32-bit, 64-bit, .NET, Java, and native payloads.

The operators claim an aggressive feature set, including automatic code signing of stubs, deep XOR encryption, a unique machine-learning evasion formula, and three bundled stealer modules—browser data, Telegram session data, and cryptocurrency wallet credentials. Distribution so far shows 46% post-infection payloads delivered via LummaC2, 31% via WebRAT, 15% via QasarRAT, and 8% via Raccoon Stealer, with attack chains continuing to evolve as the MaaS expands.