loader
HijackLoader
Named by 1 report, 5 detection rules, 0 IOC feeds and 1 tracked actor.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
HijackLoader / Penguish / Rugmi to AsyncRAT Multi-Vector Phishing Campaign
MALW_HijackLoader_ExceptionHandler_Plowshare_Dispatcher, MALW_HijackLoader_NetworkSpec17_IDAT_Carrier, MALW_HijackLoader_Penguish_Stage3_Loader_PE, MALW_HijackLoader_MultiVector_Lure_GrimResource_MSC, MALW_HijackLoader_InnoSetup_AntiTriage_Wrapper
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-007: HijackLoader customer running a 15-month multi-vector phishing campaign into an AsyncRAT-class RAT
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.