SnappyClient

SnappyClient – Malware Trends Tracker by ANY.RUN

By Stanislav Gayvoronsky

SnappyClient Exposed: Remote Access, Data Theft, and a Blind Spot for

Defenders

Key Takeaways

SnappyClient is a C++-based C2 implant first identified in December 2025, delivered through the HijackLoader malware loader.

It combines remote access (terminal, process control, file management) with data theft (keylogging, screenshots, browser and crypto wallet credentials) in a single tool.

Its primary goal appears to be cryptocurrency theft, including real-time clipboard hijacking that swaps copied wallet addresses for attacker-controlled ones.

Heavy use of AMSI bypass, Heaven's Gate, direct system calls, and transacted hollowing…