IntroductionIn August 2026, Zscaler ThreatLabz identified a new loader, which we track as 2CLoader. ThreatLabz has observed the loader being used to distribute information stealers including Vidar and Remus in addition to XWorm RAT. 2CLoader has the ability to perform a wide range of anti-analysis and evasion techniques, including indirect system calls, anti-analysis checks, and installing Windows API hooks.
2CLoader: A New Malware Loader Delivering Vidar and Remus
About this summary. This is a short excerpt from the description that Zscaler ThreatLabz published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.zscaler.com/blogs/security-research/2cloader-new-malware-loader-delivering-vidar-and-remus
Source attribution: headline and facts are from Zscaler ThreatLabz (zscaler.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
DarkCore: A Data-Theft RAT With a Session-Hijacking Browser
BlackFog researchers uncover Bee Stealer, a Windows infostealer targeting Codex and Claude data with AI-powered victim profiling.
KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims
A Windows trojan advertised on hacking forums for as little as $150 a month promises buyers access to a victim’s webcam, microphone, keystrokes and saved passwords, and…
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
Group-IB researchers analyze KGB RAT, a Windows Remote Access Trojan advertised on underground forums as being fully undetectable, featuring a built-in crypter, HVNC…
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis…
Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino
Group-IB descubre BraZetsu, un nuevo malware para Windows basado en Python que funciona como un toolkit maestro para Initial Access Brokers y potencia un marketplace…
Defender Exclusion Abuse: How Attackers Hide Malware from MDAV
See how attackers like GootKit and WhisperGate abuse Windows Defender exclusions to hide malware from AV scans — and how Huntress detects it.