CyberHappenings logo
☰
🏠 Home 📂 Browse ℹī¸ About

QuirkyLoader Malware Distributes Multiple Payloads via Email Spam Campaigns

First reported
Last updated
📰 1 unique sources, 1 articles

Summary

Hide ▲

A new malware loader called QuirkyLoader has been distributing various payloads, including Agent Tesla, AsyncRAT, and Snake Keylogger, via email spam campaigns since November 2024. The loader uses DLL side-loading and process hollowing to deliver malware into target processes. Two campaigns were observed in July 2025, targeting Taiwan and Mexico. The Taiwan campaign specifically targeted Nusoft Taiwan employees with Snake Keylogger, while the Mexico campaign delivered Remcos RAT and AsyncRAT. The loader is written in .NET languages with ahead-of-time (AOT) compilation, making it appear as though it were written in C or C++.

Timeline

  1. 21.08.2025 13:41 📰 1 articles

    QuirkyLoader Malware Loader Distributes Multiple Payloads via Email Spam Campaigns

    A new malware loader called QuirkyLoader has been distributing various payloads, including Agent Tesla, AsyncRAT, and Snake Keylogger, via email spam campaigns since November 2024. The loader uses DLL side-loading and process hollowing to deliver malware into target processes. Two campaigns were observed in July 2025, targeting Taiwan and Mexico. The Taiwan campaign specifically targeted Nusoft Taiwan employees with Snake Keylogger, while the Mexico campaign delivered Remcos RAT and AsyncRAT. The loader is written in .NET languages with ahead-of-time (AOT) compilation, making it appear as though it were written in C or C++.

    Show sources
    Open in new tab

Information Snippets