Research reports

Borrowed Machinery: SnappyClient, HijackLoader, and a Shared Codebase?

SnappyClient has only ever been seen delivered by HijackLoader, but what sits between the two varies. In some samples HijackLoader loads the payload directly. In others its config carries a 32-bit PE that unpacks SnappyClient and runs it first. Zscaler have…

ClickFix × HijackLoader: Dissecting a Live Stealer Campaign - Part 2

In Part 1, I walked through the full delivery chain, from the ClickFix lure through the MSI package, both loader stages, and into the ti64 orchestrator. By the end, the syscall table was built, ntdll was unhooked, and TinyCallProxy64 was loaded into the…

Infostealers

ClickFix × HijackLoader: Dissecting a Live Stealer Campaign - Part 1

While browsing, I randomly came across an ad telling me that human verification was required. Curious, I followed it. The site it led to was simple. Just a lonely button, asking me to click it to prove I was human. Once I did, I was given instructions: press…

Infostealers