C2Looper Updates Itself Through OneDrive DLL Sideloading to Evade Detection

C2Looper is a newly identified backdoor that gives attackers a quiet way to control a compromised Windows computer.

It can run commands, inspect the victim’s network and bring in more malware, making it a serious concern for organisations facing ransomware intrusions.

Its small set of functions is enough to give an operator a durable starting point inside a business environment.

The threat is believed to arrive through a multi-stage ClickFix chain, where victims are persuaded to run a command under the guise of fixing a browser or system problem.

That approach mirrors recent ClickFix delivery chains that turn a user action into an initial foothold.

Analysts at Zscaler identified C2Looper in July 2026 and assess, with low to medium confidence, that it is connected to a ransomware-related actor. 

Zscaler said in a report shared with Cyber Security News (CSN) that the malware is still being developed and expanded. The report says it is likely used to establish footholds for lateral movement.

The operator’s identity remains unconfirmed at this stage, leaving questions for defenders tracking potential ransomware activity across affected networks.

C2Looper Updates Itself Through OneDrive DLL Sideloading

The older C2Looper variant uses an upload command to fetch a portable executable file and store it as a DLL in the user’s local Microsoft OneDrive folder.

It then stops the OneDrive process and relies on the legitimate OneDrive executable to load the planted library.

This technique is called DLL sideloading. Windows programs sometimes load supporting libraries from their own working folders, and attackers exploit that behavior by placing a malicious file with an expected name beside a trusted program.

The visible process can look ordinary even while hostile code is running. Researchers believe this routine is C2Looper’s update mechanism, allowing operators to replace or refresh the backdoor while avoiding attention.

It also shows why defenders should examine unusual child processes, unexpected DLL files and abrupt OneDrive restarts, rather than trusting a familiar executable on name alone.

The method fits a wider pattern in which attackers borrow reputable software to conceal their work.

A recently documented signed software abuse case likewise showed how legitimate, signed applications can help launch malicious components after a ClickFix lure.

GitHub C2 Expands Operator Control

C2Looper’s first version checked its server over unencrypted HTTP, sending a username, host name and process ID before asking for tasks every second.

It could open a remote shell, run commands and download further files, creating a practical base for reconnaissance and later movement across a network.

The earlier build also contains a task-ID parsing error, but that defect was corrected in version 2.

A newer variant, internally marked version 2, moves all command-and-control activity to GitHub.

Each infected machine receives a directory in a repository, while cmd.json carries instructions, result.json holds command output and beacon.json records the bot identifier and the time of the latest successful request.

Using a mainstream code-hosting platform can make malicious traffic harder to separate from normal business activity.

The choice reflects the broader misuse of GitHub based command channels and means that security teams should investigate unfamiliar repositories, automated access and sudden outbound connections tied to suspicious processes.

Version 2 also adds file listing, expanded host discovery and a code-injection function.

Its reconnaissance gathers domain, account, software and drive details, information that can help an intruder map valuable systems before deploying another payload or ransomware.

The revised upload command retrieves files from a dedicated repository folder into the Windows temporary directory, while the run command starts a file and deletes it after successful execution.

Command output is now captured through Windows pipes instead of using an older local output file, reducing one obvious artifact.

This refinement suggests the developers are responding to operational weaknesses as they improve the tool.

The campaign’s reported ClickFix link makes user awareness important, but technical controls matter just as much.

Organisations should restrict unneeded script execution, watch for suspicious OneDrive DLL loads and review alerts involving fake verification prompts, as covered in recent ClickFix attack patterns.

Indicators of comrpomise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world