Better Security, Together

A new malware loader designated QuirkyLoader has emerged as a significant threat serving as a distribution mechanism for multiple established malware families including Agent Tesla, AsyncRAT, FormBook, and MassLogger. This loader represents a concerning development in malware delivery systems, as it enables threat actors to deploy various types of malicious payloads through a single distribution channel, amplifying the potential impact across different attack vectors.
The QuirkyLoader operates by concealing its malicious activities within seemingly legitimate processes, allowing it to evade detection while facilitating the deployment of diverse malware families. The loader’s design enables it to serve as a versatile platform for cybercriminals, providing them with the capability to distribute different types of malware depending on their specific objectives, whether focused on data theft, remote access, or credential harvesting.
QuirkyLoader demonstrates the evolution of malware distribution, showcasing sophisticated loaders that stealthily handle multiple payloads. By distributing established malware families through innovative delivery methods, cybercriminals are blending tried-and-tested attacks with new strategies.

A new sophisticated malware campaign attempted to compromise over 300 customer environments by deploying SHAMOS, a variant of Atomic macOS Stealer (AMOS). The campaign was orchestrated by the cybercriminal group COOKIE SPIDER, which operates as a malware-as-a-service provider, renting this information stealer to other cybercriminals for harvesting sensitive information and cryptocurrency assets from victims.

The attack methodology relied on malvertising to redirect users to fraudulent macOS help websites where victims were instructed to execute malicious one-line installation commands. When users searched for common macOS-related issues, such as “macos flush resolver cache,” they encountered promoted malvertising websites in their search results. This technique allows threat actors to bypass Gatekeeper security checks and install Mach-O executables directly onto victim devices, a method previously employed by Cuckoo Stealer and SHAMOS operators in Homebrew malvertising campaigns between May 2024 and January 2025.