The Rise of Stealthy Malware: Inside the Lokibot Loader Campaign

The digital landscape is becoming increasingly sophisticated, with attackers implementing innovative strategies to evade detection. Recent discoveries by security researchers have spotlighted a new and alarming form of malware loader that hides its malicious code within everyday image files. This clever tactic demonstrates the evolving complexities of cyber threats, particularly as they seek to circumvent modern detection systems.

A Stealthy Malware Loader Emerges

A newly identified variant of a .NET-based steganographic loader has caught the attention of the cybersecurity community due to its impressive ability to conceal malicious code within image files. This technique is deliberately designed to slip past antivirus tools, masquerading as harmless visual media. Researchers from the Splunk Threat Research Team (STRT) first stumbled upon this loader while examining modified samples of a previously known crypter, itself notorious for embedding malicious code within images. The newest variant, however, has elevated the threat landscape by incorporating a dedicated decryption module, making static code analysis and automated sandboxing increasingly challenging.

The infection process begins with what seems to be a routine business document, often fabricated as a “Request for Quotation” (RFQ). Upon opening this seemingly innocuous file, a series of hidden decryption steps are quietly initiated. Rather than directly loading malicious data from its embedded .NET resources, the loader extracts a concealed container module, setting the stage for more sophisticated payload delivery.

Inside the Steganographic Technique

What distinguishes this new loader from its predecessors is its multi-layered approach to hiding code. Once the container is decrypted, it reveals two image-based modules—one encoded in BMP format and the other in PNG. Each of these images carries encrypted content that represents the next stage of malware execution. Since the images remain encrypted until runtime, traditional inspection methods, which often rely on file signatures or static code scanning, are rendered ineffective.

This method of steganography allows the malware loader to disguise itself as benign digital media. As security measures advance, attackers adapt, fortifying their tactics to bypass increasingly sophisticated screening tools employed by enterprises. Once decrypted, the loader utilizes Windows APIs, such as UrlDownloadToFileW, to fetch additional payloads from remote servers, establishing persistence through scheduled tasks, ensuring that the malware can continue operating even if initial processes are terminated.

Unpacking the Lokibot Payload

After penetrating the layers of steganography, researchers found that this loader ultimately deploys Lokibot, one of the most widely distributed credential-stealing malware strains in recent history. Since its emergence in 2015, Lokibot has seen its influence grow substantially, particularly after its source code was leaked in 2018, allowing various criminal groups to craft their own variants of this threat.

Upon installation, Lokibot embarks on a mission to gather system information and harvest credentials stored in browsers, password managers, and cryptocurrency wallets. The malware can extract sensitive data from critical processes like lsass.exe while employing effective evasion techniques by injecting itself into vbc.exe, the Visual Basic compiler. This stealthy approach enhances execution while maintaining a low profile. Even as STRT analysts reviewed the associated command-and-control servers, they noted some appeared inactive, suggesting that the operators might be employing a rotation of endpoints to evade detection and prolong their operations.

Evasion Tactics and the Growing Detection Challenge

The emergence of this sophisticated malware loader illustrates a broader trend: an increasing focus not merely on bypassing antivirus measures but also on surviving the layered analytics favored by modern enterprise security teams. It demonstrates how traditional static detection methods are becoming less reliable as threats evolve.

In response to this latest campaign, STRT researchers have rolled out 26 new analytic rules aimed at capturing behavioral patterns rather than relying solely on specific signatures. These rules target various anomalies, including unusual DNS queries by the Visual Basic compiler, the deployment of executables in atypical system directories, and the creation of XML-based scheduled tasks.

However, evolving techniques, such as runtime decryption and the use of legitimate-looking file formats, challenge even the most robust detection systems. Attackers are essentially deploying loaders that function like shapeshifters, blending seamlessly into normal user activity until the moment their payloads are activated. The latest Lokibot campaign vividly illustrates a larger reality: rather than disappearing, older malware families are being quietly re-engineered for an unforgiving security ecosystem—a landscape that demands ever-inventive solutions from both attackers and defenders alike.