New 2CLoader Malware Evades Security Tools to Deploy Vidar and Remus Stealers

2CLoader is a newly identified malware loader that helps attackers place credential-stealing programs on Windows computers.

The loader was first seen in August 2026 and has mainly distributed the Vidar and Remus information stealers, alongside XWorm RAT.

These threats can collect saved passwords, browser data, session information, and other material that can support further compromise. Researchers at Zscaler identified the activity while examining samples and delivery patterns.

Zscaler said in a report shared with Cyber Security News (CSN) that 2CLoader combines several checks and execution options, letting operators tailor its behavior on a victim device.

The campaign shows why a loader can be as consequential as the stealer it launches. By hiding the payload until late in execution and changing behavior when it detects analysis, 2CLoader increases the chance that theft tools reach real users undetected.

New 2CLoader Malware Evades Security Tools

2CLoader encrypts strings and stores its configuration and payload inside a Windows executable resource. It uses rolling XOR and AES-GCM decryption, tying the final key to the loader’s own code. That makes static inspection harder.

The malware also uses indirect system calls for Windows functions commonly watched by security software. It obtains call information from a clean copy of ntdll.dll and uses the Hell’s Gate technique, an approach related to indirect syscall evasion research, to reduce visibility from user-mode hooks.

Its anti-analysis checks look for virtual-machine clues, debuggers, user inactivity, low resources, unusual usernames, and sandbox-like settings. It exits before decrypting the payload if a hard-fail check triggers or its environment score is too low.

In some builds, 2CLoader installs inline trampoline hooks in Windows APIs after decrypting the payload. These can alter usernames, computer names, registry values, environment variables, volume serial numbers, and parts of IPv4 addresses in received network data.

The aim appears to be providing later checks with misleading but correctly formatted system information. The loader can persist through Run or RunOnce registry keys, the Startup folder, a scheduled task, Windows Load settings, or a logon script.

It can also run a payload in memory, manually map it into the current process, or replace a suspended process image. This flexibility echoes large loader delivery campaigns that keep the final stealer away from file inspection.

Vidar and Remus Delivery Risk

Observed samples primarily delivered Vidar and Remus, credential-focused stealers. Researchers also found XWorm RAT, extending the risk from theft to remote control of an infected machine.

A fake receipt XWorm campaign shows how layered delivery can turn a routine-looking file into an entry point for account theft. 2CLoader communicates with command-and-control infrastructure over HTTP.

It sends XOR-encrypted JSON registration and status messages containing the operating-system version, process ID, privilege level, processor count, memory, locale, and malware path. This gives operators a record of infected devices.

Its configuration supports optional payloads and a decoy message box. One path can spoof explorer.exe as a new process’s parent and enable elevated debugging privileges; another targets dllhost.exe by default, then redirects that suspended process to the malicious payload.

These choices allow the loader to adapt to different campaigns and payload formats. Organizations should use layered endpoint and network monitoring.

Teams should investigate unusual HTTP POST requests, execution from temporary locations, suspicious scheduled tasks, and unexpected process relationships involving dllhost.exe or explorer.exe.

Keeping defenses current and limiting untrusted software execution can reduce exposure. The urgent response is to block and hunt the known indicators below, then review systems for browser credential theft and unauthorized sessions.

Since stolen credentials can enable later account abuse, affected users should reset passwords, invalidate sessions where possible, and enable multi-factor authentication after incident triage.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC